Remove DEMS Ransomware

The Dharma Ransomware and the STOP Ransomware continue to be the most active file-lockers in 2021. Their operators go after regular users instead of targeting large enterprises, and this makes them much more dangerous for the average Internet user. However, they are not the only large-scale file-encryption Trojans active currently – the Matrix Ransomware is another threat to look out for. The Matrix Ransomware project has been around for over two years, and one of its latest variants is the DEMS Ransomware. If you fall victim to this file-locker attack, you will not have access to free decryption software. Often, the only free way to recover from such attacks is to restore the files from a backup or use alternative recovery solutions.

DEMS Ransomware is the Latest Dangerous Dharma Variant

When the DEMS Ransomware infects a machine, it will immediately encrypt documents, media, files, and other content. Whenever it locks a file, the Trojan will add a new suffix to its name – [Deux69@criptext.com].[<VICTIM ID>.DEMS. It also uses the ransom message 'DEMS_README.rtf' to provide the victim with instructions on how to recover their data.

As you can probably guess, the creators of the DEMS Ransomware will not give away the recovery program for free. Instead, they extort their victims for a ransom payment that they must pay through Bitcoin. You should never agree to pay money to cybercriminals because you will probably fall victim to a scam. Many victims of the Matrix Ransomware have tried paying, only to end up losing both their money and their files.

To recover from the DEMS Ransomware attack, you should start by removing the threat itself. The best way to accomplish this is to run an up-to-date antivirus software suite. It will scan your entire computer, ensuring the removal of all files part of the ransomware. After you do this, you should try out popular data recovery tools and options.  The same tricks should be used to deal with other Dharma variants like the TCYO Ransomware.