Question
Issue: How to Recover Files Encrypted by Dharma Ransomware?
My computer has been infected with a ransomware called Dharma. The problem is that this Dharma virus has encoded all my files and added [[email protected]].dharma extensions to each of them. Is there a way to decrypt files that Dharma ransomware has corrupted?
Solved Answer
The term “Dharma virus” covers a bunch of malicious computer viruses that are currently actively distributed online. All these viruses are very similar. These viruses can be easily recognized because they append criminals’ email addresses along with .dharma, .wallet, .zzzzz or .xtbl file extension to all encrypted files. At the moment, different Dharma ransomware variants append such extensions: .[[email protected]].wallet, .[[email protected]].wallet, .[[email protected]].wallet, or, in your case, .[[email protected]].dharma file extension. The ransomware encrypts files securely – it encrypts them with RSA and AES encryption technologies, and this process converts files into useless pieces of data. Dharma ransomware typically drops a ransom note called README.txt on user’s desktop, stating that the system is not protected and that criminals can restore the data, but in order to get help, the victim has to contact them via [email protected] or whatever email address they provide. Sadly, these criminals are not willing to help you – they simply want you to pay a ransom, and such action is not the best solution to the described problem. Remember that scammers have no reputation and you should not believe in their words. They might just make off after receiving your money, also they might lose their email account in case the email service provider blocks it, and then you can lose your files for good. It is highly advisable to remove Dharma ransomware – the sooner, the better. For the best results, we suggest using trustworthy anti-malware tools. For example, you can complete Dharma removal with Reimage software. For more details about Dharma, see a full article by 2-Spyware team.
However, the most important question is, what to do with the encrypted data? If you want to restore files encrypted by Dharma virus completely, you need to have a backup. Sadly, many computer users do not consider backups as something essential to have, and so they do not create them. The truth is, if you do not have a computer protection software, you MUST create backups. It is free to create them – you just need to have an extra data storage device. If you do not have a backup, you should carefully read and try these data recovery methods. Although we cannot guarantee that these will help you to restore absolutely all files, it is always better to try.
How to recover files encrypted by Dharma ransomware?
Method 1. Use Data Recovery Pro to restore files
Data Recovery Pro by PareToLogic, Inc. This tool helps to recover lost or deleted files from computers and mobile devices. It can recover multi-media and documents, music, emails, and much more. You should definitely try this software – it might help you to restore some data corrupted by Dharma ransomware virus.
- Download Data Recovery Pro. Once the download is completed, launch the setup.
- Follow instructions the installation wizard provides.
- Scan the system with this program to identify corrupted files.
- Select affected files that you want to restore and click the Recover button.
Method 2. Use built-in System Restore feature
If you enabled System Restore function on your computer in the past, you are lucky, because now you will be able to restore encrypted files. System Restore helps to roll back to a previously saved computer’s state. If you set up a Restore Point a while ago, restore files now using Windows Previous Versions function.
- Click on an encrypted file with the right mouse button.
- When the options menu appears, choose Properties. Then go to Previous Versions tab.
- Here, find the desired copy of the file (in Folder versions). Click on the version and choose Restore.
Method 3. Use ShadowExplorer
Sometimes malicious viruses fail to carry out all malevolent functions on the target system successfully. They are programs and can be interrupted or crash as well; therefore, sometimes viruses fail to delete Volume Shadow Copies, which can restore previous file condition. To find out whether you can restore your files, do the following:
- Download ShadowExplorer.
- Install the program according to instructions that Shadow Explorer Setup Wizard provides.
- Launch the program, and select the partition that contains encrypted data. Here, select folder that you want to restore.
- Right-click on it and select Export. Optional: you can choose where to store recovered files.
Method 4. Use Crysis Decrypter
Dharma virus is reportedly related to Crysis ransomware, and recently a bunch of Crysis decryption keys was released. You can try tools provided in this Kaspersky website to restore .dharma file extension files.
Recover files and other system components automatically
To recover your files and other system components, you can use free guides by ugetfix.com experts. However, if you feel that you are not experienced enough to implement the whole recovery process yourself, we recommend using recovery solutions listed below. We have tested each of these programs and their effectiveness for you, so all you need to do is to let these tools do all the work.
Access geo-restricted video content with a VPN
Private Internet Access is a VPN that can prevent your Internet Service Provider, the government, and third-parties from tracking your online and allow you to stay completely anonymous. The software provides dedicated servers for torrenting and streaming, ensuring optimal performance and not slowing you down. You can also bypass geo-restrictions and view such services as Netflix, BBC, Disney+, and other popular streaming services without limitations, regardless of where you are.
Don’t pay ransomware authors – use alternative data recovery options
Malware attacks, particularly ransomware, are by far the biggest danger to your pictures, videos, work, or school files. Since cybercriminals use a robust encryption algorithm to lock data, it can no longer be used until a ransom in bitcoin is paid. Instead of paying hackers, you should first try to use alternative recovery methods that could help you to retrieve at least some portion of the lost data. Otherwise, you could also lose your money, along with the files. One of the best tools that could restore at least some of the encrypted files – Data Recovery Pro.
Ugnius Kiguolis is the founder and editor-in-chief of UGetFix. He is a professional security specialist and malware analyst who has been working in IT industry for over 20 years.
