What is LOCKEDS Ransomware?

LOCKEDS is a ransomware that encrypts files (photos, documents, videos) and adds the .LOCKEDS extension to them. Then it requests a ransom in the form of the Bitcoin in order to access your files.

LOCKEDS Ransomware can infect Windows 7, Windows 8.1, and Windows 10. It creates an executable file with an arbitrary name in the% AppData% or% LocalAppData% folder. This executable file runs without your knowledge and scans all drives on your computer in search of files suitable for encryption. If you see that the extension “.LOCKEDS” has been added to your files, then they are already encrypted. After that, you can’t just open these files, instead, you will see a HOW TO DECRYPT FILES.txt text file with a ransom demand in all folders where encrypted files are available, as well as on the Windows desktop. LOCKEDS Ransomware creates a text file on the desktop and in infected folders with the following contents:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail: popca@qq.com
Write this ID in the title of your message
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment, we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non-archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also, you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third-party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

There is no guarantee that your files will be returned in their original condition.
At the last stage of the infection stage, this ransomware deletes all shadow volumes on your computer. After that, you will not be able to carry out the standard procedure for recovering your encrypted data using these shadow volumes. There are two solutions to remove LOCKEDS Ransomware and decrypt .LOCKEDS files. The first is to use an automated removal tool. This method is suitable even for inexperienced users since the removal tool can delete all instances of the virus in just a few clicks. The second is to use the Manual Removal Guide. This is a more complex way that requires special computer skills.

How LOCKEDS ransomware gets on my computer?

– Spam attachments and hyperlinks
– Software vulnerabilities and exploits
– Malicious sites
– Backdoors (defects of the algorithm that are intentionally built into it by the developer and allow you to gain unauthorized access to data or remote control of the operating system and the computer as a whole)

In the process of its work, LOCKEDS places an executable file with a random name in the% TEMP% folder, modifies the Windows registry, disables the system restore function at boot, and performs all of some other actions. The encryption process itself takes from a few seconds to several minutes. In order to remove LOCKEDS Ransomware and decrypt .LOCKEDS files, as usual, we have 2 options, manual and automatic.

How to remove LOCKEDS Ransomware?

First of all, don’t panic. Follow these easy steps below.

1. Start your computer in Safe Mode with networking. To do that, restart your computer before your system starts hit F8 several times. This will LOCKEDS Ransomware system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the LOCKEDS Ransomware virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.

Recommended Solution:

You may find more detailed information about antivirus products in our article – Top 5 Antivirus Software for Windows

Restore your files using shadow copies

1. Download and run Stellar Data Recovery.
2. Select type of files you want to restore and click Next.
3. Select the drive and folder where your files are located and date that you want to restore them from and press Scan.
4. Once the scanning process is done, click Recover to restore your files.

Download Stellar Data Recovery

Step 2: Remove following files and folders of LOCKEDS Ransomware:

Related connections or other entries:

No information

Related files:

No information

How to decrypt files infected by LOCKEDS Ransomware?

You can try to use manual methods to restore and decrypt your files.

Decrypt files manually

Restore the system using System Restore

Although the latest versions of LOCKEDS Ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.

1. Initiate the search for ‘system restore‘
2. Click on the result
3. Choose the date before the infection appearance
4. Follow the on-screen instructions

Roll the files back to the previous version

Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged. This feature is available in Windows 7 and later versions.

1. LOCKEDSt-click the file and choose Properties
2. Open the Previous Version tab
3. Select the latest version and click Copy
4. Click Restore

How to prevent your system from Ransomware?

Make sure your Remote Desktop Protocol (RDP) connection is closed when you don’t use it. Also, we recommend using a strong password for this service. The most efficient way to avoid data loss is of course to make a backup of all important data from your computer.