Infected with LockCrypt Ransomware? Need to decrypt your files?
What is LockCrypt Ransomware
LockCrypt Ransomware is encryption virus, that affects user files such as photos, documents, music, videos etc. It modifies filenames using certain pattern: it changes name of the file to random numbers and letters and alters extension to .lock, .1btc or .mich. Experts now research this virus, and we don’t know if it uses symmetric or asymmetric cryptography, but currently, there is no automatic way to decrypt files encrypted by LockCrypt. But some users reported that they partially restored files, using shadow copies recovery. (Read our article about this method). Threat starts its malicious activity right after infiltration: it encrypts files and creates ReadMe.txt files with ransom payment instructions. Developers of LockCrypt demand ransom to be paid in bitcoins. We recommend removing LockCrypt ransomware as soon as possible. If you need to restore .lock, .1btc or .mich files, please read our article below. Note, that our article will be updated, and we will try to add every known LockCrypt decrypter as soon as possible.
Here is the example of ransom demanding message:
Your ID xxx
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail support: Jacob_888jk@aol.com or Jacob_888jk@bitmessage.ch
Write this ID in the title of your message
In case of no answer in 24 hours write us to theese e-mailssupport: Jacob_888jk@aol.com or Jacob_888jk@bitmessage.ch
You have to pay for decryption in Bitcoins. The price dependson how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 3 files for freedecryption. The total size of files must be less than 10Mb(nonarchived), and files should not contain valuable information.
(databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site.Youhave to register, click ‘Buy bitcoins’, and select the sellerbypayment method and price.
xxxxs://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins andbeginnersguide here:
xxxx://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software,it may cause permanent data loss.
Decryption of your files with the help of third parties maycause increased price (they add their fee to our) or you can becomea victim of a scam.
Update: Use following service to identify the version and type of ransomware you were attacked by: ID Ransomware. Also check following website for possible decryptor: Emsisoft Decryptors.
How LockCrypt Ransomware infected your PC
LockCrypt Ransomware spreads within unprotected network configuration. You can also get this ransomware on file sharing networks, including torrent files. Ransom is asked to be paid in BitCoins, that also makes the task difficult for the police, as user in this network are often anonymous. Encryption starts in the background. Way to protect your computer from such threats is to use antiviruses with crypto-protection like HitmanPro.Alert with CryptoGuard.
First of all don’t panic. Follow these easy steps below.
1. Start your computer in Safe Mode with networking. To do that, restart your computer, before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the LockCrypt Ransomware virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.
Recommended Solution:
Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to LockCrypt Ransomware – files, folders, registry keys.
*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.
Step 2: Remove following files and folders of LockCrypt Ransomware:
Remove following registry entries:
no information
Remove following files:
no information
How to decrypt files infected by LockCrypt Ransomware?
Use automated decryption tools
There is ransomware decryptor from Kaspersky that can decrypt Spora files. It is free and may help you restore files encrypted by LockCrypt Ransomware virus. Download it here:
You can also try to use manual methods to restore and decrypt your files.
Decrypt files manually
Restore the system using System Restore
Although, latest versions of LockCrypt Ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – LockCrypt Ransomware by LockCrypt Ransomware). This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Restore .lock, .1btc or .mich files using shadow copies
- Download and run Stellar Data Recovery.
- Select type of files you want to restore and click Next.
- Select the drive and folder where your files are located and date that you want to restore them from and press Scan.
- Once the scanning process is done, click Recover to restore your files.
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Information provided by: Alexey Abalmasov