How to remove .Locked virus

.Locked files virus – malware that is used by many cybercriminals for money extortion

.Locked virus is ransomware^[1] infection that enters users' computers using deceptive methods and encrypts all personal data, skipping system and few another type of files. The threat might be critical and result in a complete loss of files, or even money. Malware is a project of HiddenTear and EDA2 and is used as a Ransomware-as-a-service. For that reason, there are multiple variants of the virus, as many different affiliates employ the code, for example, Luxnut and Unlock92 ransomware. A strong encryption algorithm is used to encode data, and a .locked file extension is appended to each of them. Unfortunately, the decipher key^[2] is stored on a remote server only accessible by malware authors, and users have to pay a ransom in Bitcoin to retrieve it.

Ransomware like .Locked file virus are usually spread with the help of malicious payloads that are carried in spam email attachments or software cracks, fake updates, and similar. Additionally, cybercrooks can also use system vulnerabilities and drive-by download to inject a .locked virus into targeted machines.

Locked files virus then modifies certain Windows settings to acquire persistence and the boots every time the PC is started. Personal files are changed, and .locked extension is added, for example, picture.jpg is turned into picture.jpg.locked. Databases, text image files, pictures, videos – all become useless unless the key is obtained.

The very first variant of .Locked ransomware demanded $500 in BTC, threatening to increase the price to $1000 if the payment is not transferred within the given time frame. Victims know this from an altered desktop wallpaper, as well as a text file inserted into every folder.

The latest variant, found by independent researchers, appends [random]@LOCKED file extension and is a part of Unlock92 ransomware family. Crooks provide an email address (unk921@protonmail.com) to contact them in a ransom note which is named using random characters. It states:

Your files have been encrypted.
If you want to restore files, send one ,ore file us to e-mail: unk921@protonmail.com  
Only in case you do not receive a response from the first email address withit 24 hours, please use TOP browser from www.torproject.com and see current e-mail in http://n3r2kuzhw2hx6j5.onion (https://n3r2kuzhw2h7x6j5.tor2web.io/ – from any other browser using a TOR)
Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.

No matter how many versions of Locked ransomware crooks will come up with, experts do not recommend to pay the ransom. It has been found that some of the decryption keys provided by hackers are buggy and might completely destroy files once used. Thus, users should not keep the threat on their machines and remove .Locked virus as soon as possible.

For that, we suggest you use professional security software like FortectIntego or SpyHunterCombo Cleaner. Manual .locked file virus removal is not possible for regular users, as it requires a deep understanding of computing technology. 

Only after a .locked virus is eliminated, you can attempt file recovery from a backup or use third-party software. Beware that, if you don't get rid of .Locked virus and connect your backup device, all the data located there will be corrupted as well. 

Ransomware infection triggers

Like similar malware, the virus is encountered via infected spam attachment. A victim receives a false invoice or traffic alert which includes a ZIP or a Word file with the embedded macro code. If the victim downloads the file to the operating system, the ransomware sets out to encrypt the important documents, certificates, work accounts, reports, and family-related information. 

Furthermore, the malware can spread via a trojan. This threat provides a necessary disguise for the ransomware. Usually, a trojan is unspotted by anti-virus programs, because the file is compressed. If the user runs the file, the encryption process starts, and the machine gets infected. Nevertheless, those who have updated security software have a much higher chance of the virus being blocked by it. Beware that the sample of malware needs to be added to the anti-virus' database to be detected so that some cyber threats might be not detectable. Thus, software updates is a mandatory procedure to prevent ransomware attacks.

Also, some ransomware is observed to disperse via cracked games. So if you are a passionate gamer, be aware that despite minor PUPs attacking your computer after every game hacking, dangerous viruses might pose you a challenge as well.^[3]

Remove .Locked virus with the help of our instructions

If you are infected with .Locked ransomware, you should come to terms with the fact that the encrypted data might be lost. You can restore them from backup, but if you can't find extra copies of your important data, it may be that you won't get it back.

Secondly, manual .locked file virus removal option might not work out considering the complex structure of the ransomware and its encryption algorithm. Therefore, you are left with only one solution – remove .Locked with the assistance of a powerful anti-malware application, such as FortectIntego or SpyHunterCombo Cleaner.

Lastly, it is essential to keep it updated and run regular scans in order to ensure its full protection and enjoy safe browsing again. If you can't launch any of the previously mentioned programs, follow a guide below: