Dharma Ransomware

Dharma Ransomware is a highly malicious, ransomware-type program, and it was designed to use the AES encryption algorithm to encrypt your personal files. Its goal is to extort money from you by offering you to purchase a decryption tool. However, you should refrain from paying it, and we recommend that you remove it because there is no telling whether its developers will keep their end of the bargain. To find out more about this ransomware, we invite you to read this whole article as it contains a lot of useful information.

Our research has revealed that this malicious infection is currently being distributed via email spam. Its developers have set up a server dedicated to sending fake emails to random email addresses. The emails can masquerade as invoices, tax return forms, and so on. The email is set to contain an attached file. This attached file is Dharma Ransomware’s main executable that you can download and run. However, it may not look like an executable at first but as a PDF or some other type of file. The aim is to trick you into opening the attached file so that it could scan your computer for encryptable files and then encrypt them.

Once on your computer, Dharma Ransomware will scan it for encyptable files. Our research has shown that it does not encrypt any system files of Windows and its supporting programs such as Microsoft Internet Explorer. However, it will encrypt all other files using the Advanced Encryption Standard (AES) algorithm. This encryption algorithm offers its creators the power to prevent you from accessing your files. It distorts the encoding of the files thus corrupting them. While encrypting your files, this ransomware will append your files with the [e-mail].dharma file extension.

Once the encryption process is complete, this ransomware will change you’re the wallpaper of your desktop with an image that contains instructions on what you have to do to get your files back. The note says that our files have been encrypted and that attempting to decrypt with a third-party tool will corrupt them beyond repair. It also says that you only have 72 hours to pay the ransom because, otherwise, the developers will delete the unique decryption key that is stored on their remote server. Also, it is worth mentioning that there is no free decryption tool that could crack the encryption of Dharma Ransomware. The developers want you to message them at lavandos@dr.com, but if you do not get a reply with 24 hours, then they advise you to contact them at lavandos@india.com. Furthermore, it will drop a text file named “Hallo our dear friend.txt” on your computer’s desktop. This note also suggests that you contact one of the email addresses mentioned above.

However, you cannot trust the developers to deliver on their promise because all they are interested is money. You can pay them, but there is no guarantee that your files will be decrypted. Furthermore, the ransom note does not provide any information regarding the sum to be paid, so it can be small or large and can even vary with each case. By paying the ransom, you run the risk of losing your money. Therefore, we recommend that you take action and remove Dharma Ransomware from your PC as quickly as possible. The executable file should be located in the Downloads folder, but if you cannot locate it, then we suggest using SpyHunter to find and delete it for you.

How to remove this ransomware

1. Go to http://www.pcthreat.com/download-sph
2. Download the installer and run it.
3. Follow the installation instructions.
4. Run the program.
5. Select Scan Computer Now!
6. Then, simultaneously hold down Windows+E keys.
7. Enter the file path of the malicious files in the File Explorer’s address box and press Enter.
8. Right-click the malicious files and click Delete.
9. Empty the Recycle Bin.