Maoloa Ransomware - How to remove

Maoloa ransomware (also known as Maoloa-Alco) first appeared on February 5th 2019 when several users complained about this virus encrypting their personal files.

Encrypted files can’t be read as their data is scrambled. Because Maoloa encrypts files and asks for a ransom, it is categorized as ransomware.

Now, you could pay the ransom to the cybercriminals to try and get the decryption key – or remove the Maoloa virus from your computer and then look for alternative tools to recover your files.

It goes without saying that we recommend selecting the second method. Dealing with extortionists is dangerous. We understand that it might be really confusing for a user with no cybersecurity knowledge, but we are here to help you – please proceed reading the article and learn how to completely eliminate the Maoloa virus from your computer and also recover the data that belongs to you.

About Maoloa:

Classification	Ransomware.
How Maoloa encrypts files	It arrives in malicious email spam, it encrypts files and changes their names, it leaves behind text files – ransom notes.
How to restore your data	Restore files from backups, use file recovery tools.
How to delete Maoloa ransomware	Remove all malware and infected files with antivirus tools (such as Spyhunter).

How did Maoloa infect your computer?

Originally, Maoloa impersonated GlobeImposter. However, it is a distinct ransomware family. Some examples of Maoloa-type ransomware are Hermes666 and Hades666. Nowadays, antivirus scanners and sites like ID-Ransomware should recognize Maoloa ransomware.

There are many ways in which ransomware spreads, but spam emails tend to be the most popular. It’s the number 1 distribution method for Maoloa ransomware. How do they do it? Well, Social engineering is involved. Scammers craft convincing emails to catch the attention of the victim. Then, they claim that the other piece of this extremely important information is on the document attached to the letter.

The document usually is made to look like a PDF or Doc. Other times, it’s a Zip archive. Once the file is opened (and, if needed, macros are enabled), the file downloads Maoloa and other malware. Yep, all it takes to get infected is to open that attachment.

Needless to say, be careful of urgent-but-vague emails that come with attachements.

It’s also helpful to protect your computer with a trustworthy anti-malware application. Feel free to take a look at our reviews section, where you will be able to learn more about anti-malware tools. We recommend Spyhunter, but any reputable antivirus tool that has real-time security can help protect you from ransomware.

The encryption by the Maoloa virus

The methods used by the Maoloa virus are not any different from those used by other viruses of this type. We have examined infections like WastedLocker, Healforyou and they all use the same secure encryption algorithm to change the contents of your files into unreadable gibberish.

Indeed, if you were to open an encrypted text file, it would show a bunch of random symbols. This is how Maoloa breaks user files – not just text files, but also documents, spreadsheets, pictures, videos, and others.

After the encryption, it will attach .maoloa, .Globeimposter-Alpha865qqz, or another extension to the end of every single encrypted file and place “HOW BACK YOUR FILES.txt” document on your screen. It is a ransom note and it goes like this:

** All your files have been encrypted **
*** PLEASE READ THIS ***
**** IF YOU WANT TO GET ALL YOUR FILES BACK ****
_______________________________________________________
| ATTENTION |
| * Do not rename encrypted files. |
| * Do not try to decrypt your data using third party software, this can |
| result in complete data loss. |
|_______________________________________________________|

Send us email with your personal id.
This email will be as confirmation you are ready to pay for decryption key.
After payment, we send you the decryption tool, that decrypt all your files.

Before paying you can send 2 file for free decryption. The total size of file
must be less than 1Mb (non archived), and files should not contain valuable
information (backups, databases, large excel-word sheets, etc.)

CONTACT US: [email protected], [email protected], [email protected]

————————————- KEY ————————————-
–
——————————————————————————-

It’s not known how much you will be asked to pay. The extortionists want you to contact them first via one of these email addresses: [email protected], [email protected], [email protected].

You should not do that. Paying the ransom is risky, as the Maoloa extortionists might just take your money and leave. First, look into other methods for getting your data back, such as data recovery programs (EaseUS). Also, consider if you have any safe backups of your important files.

Automatic Malware removal tools

How to recover Maoloa Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Maoloa Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Maoloa Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Maoloa Ransomware. You can check other tools here.  

Step 3. Restore Maoloa Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Maoloa Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Maoloa Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.