Locky Virus Removal

This page article will help you to Remove Locky Virus. The Locky Virus Removal instructions will work for all versions of Microsoft Windows.

If your files have already been changed into .locky extension do not panic! as strange it may look like, this is unfortunate and means that a ransomware virus called .Locky Virus extension took over your system.

This is a brand new cryptoinfection belonging into the ransomware family. This ransomware program utilizes a different encryption method than its variations – the AES-128 military grade encryption. The Aes-128 encryption is a step up for the programmers of crime software. The targets of this attack are predominantly German people, but other countries may also get hit hard. The _Locky_recover_instructions.txt ransom note is just as a lot of others ransomware notes, so this is a general shoutout: DO NOT PAY UP!

The criminals are hoping that the surprise of loosing all your files will shock you and you will pay them the ransom. However this is not a good idea, for a couple of reasons.

• Paying money to cyber criminals only encourages them to get better at their craft and extort even more people.
• You are not guaranteed in any way that your files will be decrypted successfully if you make the payment.
• There is absolutely no reason to pay until you’ve tried all the free methods first.
• Antimalware and Antivirus companies are constantly developing their products to fight the bad guys.

Attention! You should be aware that all of your accounts and passwords were likely compromised. Viruses are designed to collect every piece of private information. We advise you to change all your passwords, once you clean your computer, especially if you make online banking or shopping.

How Can I Remove .Locky Encryption Virus?

SpyHunter is the recommended removal tool for the .Locky Virus File Encryption ransomware. You can use the free scanner to detect the parasite, however if you want to delete it automatically you need to register the antimalware program.
What if SpyHunter failed to Detect or Remove the infection? – Find out here how to use the FREE Support.

How did I get infected?

The Locky Virus is currently distributed via email called ATTN: Invoice J-98223146 the message states “Please see the attached invoice (Microsoft Word Document) and remit payment according to the terms listed at the bottom of the invoice”.

When the document is opened, a text will be scrambled and will ask you a message to enable macros in order to read the invoice. Once you enable the macros the virus will execute from a remote server and your computer will get infected with Locky virus. Locky will create ransom notes called _Locky_recover_instructions.txt. Containing the following text:

!!! IMPORTANT INFORMATION !!!!
All of your files are encrypted with RSA-2048 and AES-128
ciphers.
More information about the RSA and AES can be found here:
hxxps://en.wikipedia.org/wiki/RSA_(cryptosystem)
hxxps://en.wikipedia.org/wiki/Advanced_Encryption_Standard
Decrypting of your files is only possible with the private key
and decrypt program, which is on our secret server.
To receive your private key follow one of the links:
1. hxxp://6dtxxxxm4crv6rr6.tor2web.org/07Bxxx75DC646805
2. hxxp://6dtxxxxgqam4crv6rr6.onion.to/07Bxxx75DC646805
3. hxxp://6dtxxxxgqam4crv6rr6.onion.cab/07Bxxx75DC646805
4. hxxp://6dtxxxxgqam4crv6rr6.onion.link/07Bxxx75DC646805
If all of this addresses are not available, follow these steps:
1. Download and install Tor Browser:
hxxps://www.torproject.org/download/download-easy.html
2. After a successful installation, run the browser and wait for
initialization.
3. Type in the address bar:
6dtxxxxm4crv6rr6.onion/07Bxxx75DC646805
4. Follow the instructions on the site.
!!! Your personal identification ID: 07Bxxx75DC646805 !!!

What can I do?

The first thing it to delete .Locky Virus, because any new files you transfer will also get encrypted and you will loose them. Unfortunately, just getting rid of the virus will not bring your files back. What you can actually do is recover the originals. It depends on the empty space of your HDD at the time of deletion and also how many data was written on the drive before the infection. The Cryminals offer to download Locky Decripter, however this should be the very very last option.

Remove Locky Virus infection Manually

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously and go to the Processes TAB
• Locate the process of the Ransomware. Have in mind that this is usually a random generated file, but in this case the ransomware starts a process called SVCHOST.EXE and is located in the %temp% folder
• Navigate to your %appdata%/roaming folder and delete the executable.
• Then open your Windows Registry Editor and navigate to

HKEY_LOCAL_MACHINE–Software–Locky–id
HKEY_CURRENT_USER–Software–Locky–pubkey
HKEY_CURRENT_USER–Software–Locky–paytext
HKEY_CURRENT_USER–Software–Locky–completed

The virus temporary creates an “svchost.exe” process with the Description “svchost.exe”. When the encryption of your files finishes it deletes itself from the system.

How can I decrypt .Locky files?

 It is reccomended first to remove the Locky Virus to prevent further damage.

1. The first step to recover your lost files is a full system restore. To do this type System Restore in the windows search field and choose a restore point. Click Next until done.
2. The second option is to use a data recovery software that might find some important documents.
3. The third option is a program called Shadow Volume Copies. However, the recent ransomware infections delete the files necessary to fulfil the recovery process, but you can give a try.