What is Locky virus?
Locky virus is ransomware threat that encrypts documents, music, video and other information on victims computer using AES encryption. This virus can also encrypt folders on unmapped network shares. It modifies affected files extensions to .locky. After this it demands ransom in bitcoins (0.5 – 2 BTC or approximately $200 – $800) for decryption services. There is no known guaranteed way to decrypt files infected by Locky virus and that is why this blackmail virus is considered very harmful. Use instructions below to remove Locky virus and decrypt .locky files.
How Locky virus gets on your PC?
There is certain common way that Locky ransomware uses to get installed on users computers. It is distributed with spam e-mails as an attachments. Usually attachment is called “invoice-(random letters and numbers” and is in .doc or .xls format. Letter says “Please see the attached invoice”. When user downloads and run this file it asks to enable macros support in the document. Once enabled there is no way back, as virus downloads core executable and starts encryption process on your computer. Be careful reading your mail and do not download attachments from unknown senders. Use crypto-protection software to protect from files encryption.
How to remove Locky virus from your computer?
In our view, there are 3 products that potentially have Locky virus in their database. You can try to use them for removing Locky virus.
Recommended Solution:
Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to Locky virus – files, folders, registry keys.
*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.
Alternative Solution:
Norton Antivirus – detects files, registry values and folders of viruses that show the same behavior as Locky virus.
You can try both of these products to remove Locky virus
Step 1: Remove Locky virus from Control Panel
Step 2: Remove following files and folders of Locky virus:
Remove following registry entries:
HKCU\Software\Locky
HKCU\Software\Locky\id
HKCU\Software\Locky\pubkey
HKCU\Software\Locky\paytext
HKCU\Software\Locky\completed
Key: HKCU\Control Panel\Desktop\Wallpaper
Value: "%UserProfile%\Desktop\_Locky_recover_instructions.bmp"
Remove following files:
%UserpProfile%\Desktop\_Locky_recover_instructions.bmp
%UserpProfile%\Desktop\_Locky_recover_instructions.txt
%Temp%\(random).exe
How to decrypt files infected by Locky Ransomware (.locky files)?
Use the decryption tool
There is currently no automated decryption tool for .locky files, but that doesn’t mean that you need to pay the ransom. We track the topic and will add any decryption tool available in this part of the article. Now you can try to use manual methods to restore and decrypt files infected by .locky.
Decrypt .locky files manually
Restore the system using System Restore
Although, latest versions of Locky ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – encrypted by Locky virus). This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Restore .locky files using shadow copies
- Download and run Shadow Explorer.
- Select the drive and folder where your files are located and date that you want to restore them from.
- Right-click on folder you want to restore and select Export.
- Once the scanning process is done, click Recover to restore your files.
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Information provided by: Alexey Abalmasov