Be Careful to Uninstall [[email protected]].LOVE ransomware instantly

Has your personal files been encrypted by [[email protected]].LOVE ransomware?  If yes then you are in trouble because your data has got locked the popular Dharma ransomware. This is one of the most dangerous data-encryption malware whose decryption key has been available till now. Like other ransomware, this malware also encrypt or lock the targeted files and makes it totally inaccessible. They display threatening messages on the screen asking you to pay certain money as ransom in exchange of the decryption key. There is a big question mark that whether the provided decryption key by the cyber-criminals works or not.

Let examine the [[email protected]].LOVE ransomware in Details:

This Dharma ransomware variant restricts the users to access their personal data. Their aim is to extort money from the innocent victims by deceiving them to pay money for decryption key which actually is bogus and spam in most cases. It sends a ransom note that demands the victims to pay $500 to $1500 in Bitcoin virtual currency to a particular wallet address belonging to cyber-criminals. This ransom note appears on the screen every time when you try to access the locked files. The payloads and scripts of this ransomware get stored in %AppData% or %LocalAppData% folder. After successfully getting installed, it does a quick scan of PC hard-disk in search of the files and programs that it can encrypt. It is capable to lock particular group and set of files extension that could be belonging to your personal audios, videos, MS Office docs and so on. Some of the files extensions that it can encrypt are:

.sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt

The ransom note is written in a text file named as “FILES ENCRYPTED.txt”. This note file is stored in the desktop as well as in every folder that contains the locked files. It also tries to delete the available “Shadow Volume Copies” so that user cannot recover the locked files other than paying the ransom money.

“The files encrypted by [[email protected]].LOVE ransomware is no longer accessible. It adds [[email protected]].LOVE extension in every file that it encrypts. Its ransom note says:

All your files have been encrypted!

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected]

Write this ID in the title of your message

In case of no answer in 24 hours write us to these emails: [email protected]

You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.

Free decryption as guarantee

Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)

How to obtain Bitcoins

The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.

Also you can find other places to buy Bitcoins and beginners guide here:


Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

all your data has been locked us

You want to return?

write email [email protected] or [email protected]

How to Recover the Encrypted files:

Unfortunately, there is no way to recover the locked files unless you have the decryption key. You may thing to pay money to cyber-criminals to get this decryption key but again there is a spam. The cyber-criminals don’t provide the original decryption even after receiving the money and continue encrypting other files and program. So, you will lose your time and money as well. So, it is advised to focus on removing the file and payloads associated with [[email protected]].LOVE ransomware from the PC. Once the malware is removed, you can use the backup files or use a third-party data recovery tool.

Precautionary Measures

  • Browse carefully and don’t click on random links and pop-ups
  • Read the terms and agreement carefully before downloading any application
  • Always choose advance or custom installation method
  • Uncheck all the preselected and suspicious programs and stop them from getting installed
  • Careful from spam email campaigns
  • Upgrade the security settings by using a powerful anti-malware tool


Leave a reply