Severity scale:  

Maktub Locker virus. How to remove? (Uninstall guide)

removal by Jake Doevan - - | Type: Ransomware

Maktub Locker virus – another ransom demanding computer threat

Computer users should be aware of a new ransomware, called Maktub Locker. It is a computer infection that can make all user’s files inaccessible. The cyber criminals send this virus via email – they send attachments disguised as Terms of Service update. Judging by the file icon, it seems to be .txt or .pdf document, but in reality, it is a .scr file. If a user downloads and launches such file, it opens up an actual document, but it also runs a malicious process in the background. Maktub Locker ransomware scans the whole computer system for personal files and encrypts them using the AES-256 encryption algorithm. What is interesting, is that the file size drops after the encryption. It is also notable that this virus attaches a file extension to the filenames of encrypted data. For each victim, the extension is randomly generated.

After the data encryption is done, Maktub Locker virus leaves a ransom note – a .html file, which is named _DECRYPT_INFO_(random code here). This message provides information what happened to the computer. It states that the personal files were encrypted using “the strongest encryption and unique key, generated for this computer.” It promises to give the decryption key if the user pays the ransom in a particular period of time, but if the user decides not to do as commanded, the unique decryption key will be destroyed for good. Like any other ransomware, Maktub Locker asks to install Tor browser and go to one of the URLs provided to access the secret server. Then, using a given code, the user can enter a special website designed only for him/her. It’s a website, which is incomparable to the websites provided by other ransomware viruses. It is designed quite well, and the information on it is written faultlessly.

Maktub Locker virus ransom note

This site consists of 5 different pages. It starts with a “HELLO!” Page. Criminals state that the files have been encrypted, but they are not gone yet – the user can get them back by buying them out. The second page, titled “WE ARE NOT LYING!”, informs that googling “Maktub Locker” will advise the victim to remove this virus immediately. According to the cyber criminals, no programs except of the one this virus provides will help the victim to decrypt the data. It even suggests uploading two files to test the decryption key. The next page, called “HOW MUCH DOES IT COST?”, explains that one must pay the ransom as soon as possible. Otherwise, the ransom price will increase. If the victim pays the ransom within the three days of infection, he/she has to pay approximately 588 US dollars. Later on, the price increases every three days. The virus announces that it does not guarantee to keep the decryption key more than 15 days. It informs that the site can be disconnected at any moment, and then victim’s data will be lost forever. The fourth page is called “WHERE DO I PAY?” It explains that victim needs to pay the ransom in Bitcoins and then wait a few hours. The fifth page, titled “BITCOIN PURCHASE,” provides information about Bitcoin payment system and lists websites where the user can buy Bitcoins.

What to do if Maktub Locker virus infects your computer?

First of all, you have to decide whether you wish to support cyber criminals or not. If you pay the ransom, it only strengthens them and makes them believe that people are submissive and afraid of computer viruses. As a consequence, that encourages them create even more complex viruses and demand bigger ransoms. Besides, do you believe that criminals are actually going to give you the decryption key?

If you decide not to pay up, you must remove Maktub Locker from your computer immediately. It is a must to delete all of its components. Otherwise, its remains might download similar viruses to your computer. In addition, if you do not remember opening any suspicious emails, it might be that you have a trojan installed on your computer, which could download this virus into your PC. It is hard to detect trojans, and that is why we recommend users who were affected by Maktub virus to download a reliable anti-malware software and scan the compromised computer with it.
You can use Reimage program.


Question: I have already deleted this virus but how can I decrypt the data?

Answer: Unfortunately, no decryption utility for Maktub Locker ransomware is found yet. That is why we encourage computer users to create and keep data backups on external drives, unplugged from the computer.

Question: How can I prevent Maktub Locker virus attack?

Answer: It is quite easy – just stay away from suspicious emails sent by people you do not personally know, avoid visiting suspicious websites and refrain yourself from clicking on pushy banners or pop-up ads. However, it is also strongly recommended to protect your computer with a help of anti-malware program.

How to remove Maktub Locker?

We do not recommend dealing with Maktub Locker ransomware manually. It is a disastrious and well-constructed virus, which tends to hide its components in the computer system. If you are an inexperienced PC user, we suggest you to use a strong malware removal program, for example, Reimage. If you still wish to remove this virus manually, follow Maktub Locker removal guide, which is provided below.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Maktub Locker virus you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Maktub Locker virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.
Press mentions on Reimage

Manual Maktub Locker virus Removal Guide:

Remove Maktub Locker using Safe Mode with Networking

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Maktub Locker

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Maktub Locker removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Maktub Locker using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Maktub Locker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Maktub Locker removal is performed successfully.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Maktub Locker and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions

Removal guides in other languages

  • zigm

    I have become a victim of Maktub, too. I regret so much that I did not backup my files earlier…

  • Volfiii

    Damn virus! Ill backup my files. Thanks for the information.

  • Gerber24

    So there is no way to decrypt the files?

    • Sandrahh

      seems that no… ive been searching for a decryption tool, too, unfortunately, no luck… I dont know whether should I pay up or no, I dont touch my PC now. I dont want to pay, they ask for just really a lot of money…