Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Decrypt Files Encrypted by Ransomware Viruses Part 3

sensorstechforum-com-ransomware-viruses-decrypt-part-3A lot has happened since we released the previous part with ransomware decryption instructions. Many viruses which were initially thought to be impenetrable have been decoded and brought new hope for those who do not want to pay money to cyber-criminals. Unfortunately, some of those viruses came in new variants which were improved, and these updated variants continue to cause infections up to this current moment. Despite this, there are many victims of those viruses when you put them altogether. If you are a victim of one of the ransomware viruses below, you should click on its web link where you can find the relevant instructions that will help you decrypt your files.

Decrypt Files Encrypted by Ransomware Viruses Part 1
Decrypt Files Encrypted by Ransomware Viruses Part 2

DMA Locker 3.0 Decryption

Unlike the previous DMA Locker full of flaws, this version is significantly more complicated. New features like a BSOD error and a direct restart of the victim PCs, as well as updated ransom note and multiple patched flaws in the code, appeared in the 3rd version.

Luckily an experienced malware researcher, going by the name hasherezade (@hasherezade) has first come up with decryption instructions and software for three infection waves of DMA Locker. The researcher managed to successfully decrypt the following DMA Locks:

→ DMALOCK 38:34:69:41:46:73:32:55
DMALOCK 51:34:11:63:80:61:23:19
DMALOCK 40:12:16:43:65:40:70:17

For full instructions on how to decrypt files that have been encoded by DMALocker, please visit the following article:

DMALocker 3.0 Decryption Instructions

FenixLocker Ransomware Decryption

Ransomware, first encountered in September using the e-mail .centrumfr@india.com!!, called FenixLocker had been reported to use the AES cipher and leave behind ransom notes with the name “Cryptolocker”. The virus was dubbed FenixLocker and demands 500$ from it’s victims. Malware researchers at EmsiSoft managed to render this virus into the past, by developing a free decryptor for the virus. Below you can see the full instructions and restore your files for free:

FenixLocker Virus – Decrypt .centrumfr@india.com!! Files

JokeFromMars (MarsJoke) Ransomware Decryption

A ransomware virus using two file extensions – .a19 and .ap19 and asking 0.7 and 1.1 BTC called JokeFromMars or MarsJoke has nothing to do with jokes. When the virus first appeared it was mainly focused on targeting organizations, more specifically government buildings. Not only this, but the MarsJoke virus was also reported to drop a malicious file carrying the name “sysmonitor.exe” which performed several malicious activities on Windows like modify the registry editor and encrypt the files on the computer with an AES-256 algorithm, rendering them useless.

Thankfully, users do not have to pay in BitCoin now that a decryptor has been released, turning this ransomware into an actual joke. Full instructions for decrypting your files for free are available below:

Decrypt Files Encrypted by MarsJoke Ransomware

Purge or Globe Ransomware Decryption

One of the many Jigsaw variants, this ransomware, was expected to be decrypted just as it actually happened. Researchers at TrendMicro have turned their attention to this variant and updated their TrendMicro decrypter with Purge/Globe included in it. If you are looking how to decrypt your files in case they have been attacked by Purge, you can see in the article below.

Decrypt Files Encrypted by Globe and Purge Ransomware

DXXD Server Ransomware Decryption

A ransomware virus for Windows Server 2012, displaying a fake Windows Update screen asking any server administrators to contact shellexec@protonmail.com as well as null_ptr@tutanota.de for more information. Not only this but also according to reports by ESG malware researchers, this ransomware virus was most likely created by experienced professionals who aimed to target servers of different networks, most likely small or medium-sized businesses.

However, this ransomware was also decryptable, as it turned out later on. Full instructions are available in the below-mentioned article about DXXD.

DXXD Server Ransomware Remove and Decrypt Encoded Files

Ransomware Decryption Part 3 Conclusion

With more and more emerging ransomware threats, more and more file decryptors become available, and this is primarily due to the bad code in some viruses. However, the bad news is that these decryptable malware instances are small in number in comparison to the overall number of ransomware viruses that appeared for 2016. Not only this but the top names of ransomware have succeeded not only because of the experienced coders behind them but also because of the techniques they use to globally spread the malware. Users should know how to protect themselves and their data from such malware to avoid such occurrences.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.