Dotmap Virus - How to remove

Dotmap is ransomware — a type of computer virus that restricts the victim’s access to their computer or files, and demand money for fixing the situation. Files locked by Dotmap have the .dotmap extension, with the file names having .dotmap appended to their names, like picture.jpg.dotmap. If you find this happened to you, you must have been infected with the Dotmap virus.

Dotmap is the file-locking type of ransomware and a member of the DJVU family. These are usually very difficult to solve, and the best defense is prevention. Still, there are a few things to try that can probably recover a few files without having to pay hundreds of dollars to the criminals behind Dotmap.

Dotmap’s impact

The virus encrypts user-created files, like pictures, documents, videos. Encrypted files are locked and become unusable. The way that encryption works means that, if the virus didn’t encounter technical difficulties (like the internet connection to Dotmap’s server not working), only the developers of Dotmap have the decryption keys. These keys, unique to each victim of Dotmap, could be used to reverse the decryption. However, online extortionists are notorious for taking the money, but not fixing the locked files. Keep in mind to not give the criminals more than you are willing to lose.

Dotmap sometimes comes with spyware which can collect private information like passwords. Ultimately, this could result in money being lost, so make sure that no malware is on your computer before using it to do any financial activities.

Details

A _readme.txt file containing a message from the extortionists is left for the victims of Dotmap. It starts like this:

ATTENTION!
Don’t worry my friend, you can return all your files!

The note is the same as the other DJVU virus notes, like Promorad2, Rumba, and Guvara. Like the other viruses, Dotmap’s creators ask for $490 and to be contacted without delay. This is so that the victims of Dotmap don’t spend too much time researching alternative solutions.

How to remove Dotmap

Dotmap might have deleted itself, actually. But it is still important to scan your machine for threats. If any spyware Trojans were being distributed with your version of Dotmp, as soon as you can, scan your computer (using a professional and trusted antivirus program, for example, Spyhunter). Remove all the malicious files and programs.

If you find that you cannot access some websites, this article can probably help.

Automatic Malware removal tools

How to recover Dotmap Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Dotmap has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Dotmap Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Dotmap. You can check other tools here.  

Step 3. Restore Dotmap Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Dotmap tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Dotmap Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.