How to remove THTLocker ransomware virus

THTLocker comes as a backup to Onion3Cry ransomware

THTLocker virus operates as ransomware^[1] which is closely associated with HiddenTear-based Onion3Cry threat. Researchers spotted it operating independently as well as cooperating with the latter virus. Except the fact that it is created on the source code pattern of the HiddenTear, the malware does not exhibit any particular exceptional features.

The ransom message discloses limited information. The first line in Russian^[2] says that all your important files are collected. Further lines identify the name of the ransomware – THTLocker.

According to the trojan names^[3], the malware executable cryptolocker.exe, even it does not have any technical resemblance to the original Cryptolocker virus. Such feature is most likely to be used for alarming purposes to encourage victims to pay the ransom.

Taking a closer look, it becomes clear that THT Locker is a screen locker rather than a genuine file-encrypting threat. Luckily, most of the security tools detect the malware as Ransom_LOCKSCARE.A or trojan.GenericKD.12399747.
Thus, the malware is unlikely to encode the files but rather lock your computer temporarily. In order to gain access, click on Alt+F4. Remove THTLocker malware. You can use FortectIntego or MalwarebytesMalwarebytes for that purpose.

Note that deleting cryptolocker.exe file will not eliminate the very malware. Since it is related to Onion3Cry malware, check whether some of your files are not encrypted. It is not recommended to remit the payment since the malware still seems to be in the initial stage of development.

There is no guarantee that the perpetrators return files after receiving the ransom. Furthermore, though there have been ample of HiddenTear-based ransomware samples created, there is still hope that the free decrypter designed for the original malware may work. Now let us discuss distribution trends and THTLocker removal options.

Preventing the assault of ransomware

This malware is likely to have spread via spam emails. Thus, beware of the emails which such message content: “Files attached. Thanks” “Please check the status of the invoice,” etc. Though Ykcol malware uses such style, THTLocker developers might rip off some ideas as well.

You should be also wary of opening shady video links and downloading content from websites with poor protection and an excessive amount of ads. Fortify the protection of cyber security by adding malware elimination tools and a firewall program. Likewise, the risk of THTLocker hijack will significantly decrease.

Ways to delete THTLocker infection

Depending on whether you got THTLocker screen locker or Onion3Cry ransomware as well, the elimination process might be slightly more troublesome. In any case, you will need malware elimination utility. It should not take long to remove THTLocker virus.

In case the malware meddles with the system files, you might need to reboot the system into Safe Mode and then complete THTLocker removal. In case some of the files have been encrypted, take a look at data recovery suggestions.