What is Locky virus?
Locky virus is ransomware threat that encrypts documents, music, video and other information on victims computer using AES encryption. This virus can also encrypt folders on unmapped network shares. It modifies affected files extensions to .locky. After this it demands ransom in bitcoins (0.5 – 2 BTC or approximately $200 – $800) for decryption services. There is no known guaranteed way to decrypt files infected by Locky virus and that is why this blackmail virus is considered very harmful. Use instructions below to remove Locky virus and decrypt .locky files.
How Locky virus gets on your PC?
There is certain common way that Locky ransomware uses to get installed on users computers. It is distributed with spam e-mails as an attachments. Usually attachment is called “invoice-(random letters and numbers” and is in .doc or .xls format. Letter says “Please see the attached invoice”. When user downloads and run this file it asks to enable macros support in the document. Once enabled there is no way back, as virus downloads core executable and starts encryption process on your computer. Be careful reading your mail and do not download attachments from unknown senders. Use crypto-protection software to protect from files encryption.
How to remove Locky virus from your computer?
In our view, there are 3 products that potentially have Locky virus in their database. You can try to use them for removing Locky virus.
Try SpyHunter
SpyHunter is a powerful tool that is able to keep your Windows clean. It would automatically search out and delete all elements related to malware. It is not only the easiest way to eliminate malware but also the safest and most assuring one. The full version of SpyHunter costs $42 (you get 6 months of subscription). By clicking the button, you agree to EULA and Privacy Policy. Downloading will start automatically.
Try Stellar Data Recovery
Stellar Data Recovery is one of the most effective tools that can recover lost and corrupted files — documents, emails, pictures, videos, audio files, and more — on any Windows device. The powerful scan engine can detect compromised files and finally save them to specified destination. Despite its advancedness, it’s very concise and simple so that even the most inexperienced user can figure it out.
Try MailWasher
Email security is the first line of defense against ransomware viruses. To do this, we recommend that you use MailWasher. MailWasher blocks ransomware viruses coming through spam and phishing, and automatically detects malicious attachments and URLs. In addition, malicious messages can be blocked even before the recipient opens them. Since the main source of the spread of ransomware viruses are infected emails, antispam significantly reduces the risk of a virus appearing on your computer.
You can try both of these products to remove Locky virus
Step 1: Remove Locky virus from Control Panel
Step 2: Remove following files and folders of Locky virus:
Remove following registry entries:
HKCU\Software\Locky
HKCU\Software\Locky\id
HKCU\Software\Locky\pubkey
HKCU\Software\Locky\paytext
HKCU\Software\Locky\completed
Key: HKCU\Control Panel\Desktop\Wallpaper
Value: "%UserProfile%\Desktop\_Locky_recover_instructions.bmp"
Remove following files:
%UserpProfile%\Desktop\_Locky_recover_instructions.bmp
%UserpProfile%\Desktop\_Locky_recover_instructions.txt
%Temp%\(random).exe
How to decrypt files infected by Locky Ransomware (.locky files)?
Use the decryption tool
There is currently no automated decryption tool for .locky files, but that doesn’t mean that you need to pay the ransom. We track the topic and will add any decryption tool available in this part of the article. Now you can try to use manual methods to restore and decrypt files infected by .locky.
Decrypt .locky files manually
Restore the system using System Restore
Although, latest versions of Locky ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – encrypted by Locky virus). This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Restore .locky files using shadow copies
- Download and run Shadow Explorer.
- Select the drive and folder where your files are located and date that you want to restore them from.
- Right-click on folder you want to restore and select Export.
- Once the scanning process is done, click Recover to restore your files.
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Information provided by: Alexey Abalmasov