A lot has happened since we released the previous part with ransomware decryption instructions. Many viruses which were initially thought to be impenetrable have been decoded and brought new hope for those who do not want to pay money to cyber-criminals. Unfortunately, some of those viruses came in new variants which were improved, and these updated variants continue to cause infections up to this current moment. Despite this, there are many victims of those viruses when you put them altogether. If you are a victim of one of the ransomware viruses below, you should click on its web link where you can find the relevant instructions that will help you decrypt your files.
Decrypt Files Encrypted by Ransomware Viruses Part 2
DMA Locker 3.0 Decryption
Unlike the previous DMA Locker full of flaws, this version is significantly more complicated. New features like a BSOD error and a direct restart of the victim PCs, as well as updated ransom note and multiple patched flaws in the code, appeared in the 3rd version.
Luckily an experienced malware researcher, going by the name hasherezade (@hasherezade) has first come up with decryption instructions and software for three infection waves of DMA Locker. The researcher managed to successfully decrypt the following DMA Locks:
→ DMALOCK 38:34:69:41:46:73:32:55
DMALOCK 51:34:11:63:80:61:23:19
DMALOCK 40:12:16:43:65:40:70:17
For full instructions on how to decrypt files that have been encoded by DMALocker, please visit the following article:
FenixLocker Ransomware Decryption
Ransomware, first encountered in September using the e-mail [email protected]!!, called FenixLocker had been reported to use the AES cipher and leave behind ransom notes with the name “Cryptolocker”. The virus was dubbed FenixLocker and demands 500$ from it’s victims. Malware researchers at EmsiSoft managed to render this virus into the past, by developing a free decryptor for the virus. Below you can see the full instructions and restore your files for free:
JokeFromMars (MarsJoke) Ransomware Decryption
A ransomware virus using two file extensions – .a19 and .ap19 and asking 0.7 and 1.1 BTC called JokeFromMars or MarsJoke has nothing to do with jokes. When the virus first appeared it was mainly focused on targeting organizations, more specifically government buildings. Not only this, but the MarsJoke virus was also reported to drop a malicious file carrying the name “sysmonitor.exe” which performed several malicious activities on Windows like modify the registry editor and encrypt the files on the computer with an AES-256 algorithm, rendering them useless.
Thankfully, users do not have to pay in BitCoin now that a decryptor has been released, turning this ransomware into an actual joke. Full instructions for decrypting your files for free are available below:
Purge or Globe Ransomware Decryption
One of the many Jigsaw variants, this ransomware, was expected to be decrypted just as it actually happened. Researchers at TrendMicro have turned their attention to this variant and updated their TrendMicro decrypter with Purge/Globe included in it. If you are looking how to decrypt your files in case they have been attacked by Purge, you can see in the article below.
DXXD Server Ransomware Decryption
A ransomware virus for Windows Server 2012, displaying a fake Windows Update screen asking any server administrators to contact [email protected] as well as [email protected] for more information. Not only this but also according to reports by ESG malware researchers, this ransomware virus was most likely created by experienced professionals who aimed to target servers of different networks, most likely small or medium-sized businesses.
However, this ransomware was also decryptable, as it turned out later on. Full instructions are available in the below-mentioned article about DXXD.
Ransomware Decryption Part 3 Conclusion
With more and more emerging ransomware threats, more and more file decryptors become available, and this is primarily due to the bad code in some viruses. However, the bad news is that these decryptable malware instances are small in number in comparison to the overall number of ransomware viruses that appeared for 2016. Not only this but the top names of ransomware have succeeded not only because of the experienced coders behind them but also because of the techniques they use to globally spread the malware. Users should know how to protect themselves and their data from such malware to avoid such occurrences.
