Severity scale:  
  (90/100)

FilesLocker ransomware. How to remove? (Uninstall guide)

removal by Alice Woods - - | Type: Ransomware

FilesLocker ransomware is a cryptovirus that targets Chinese and English-speaking users

FilesLocker ransomware
FilesLocker ransomware is a virus that spreads around the world via spam email attachments.

FilesLocker ransomware — a dangerous cryptovirus that creates ransom notes either in Chinese or English languages. This fact makes this ransomware even more hazardous as its targetted regions cover a huge part of the world. Alternatively known as FilesL0cker RAN$OMWARE, the threat encrypts user's data and marks files using the .locked file extension. This file appendix reminds a lot of different cyber threats using the same marker for encoded files, for example, .locked virus. After a quick encryption process,[1] FilesLocker places “#解密我的文件#.txt” and “#DECRYPT MY FILES#.txt” on every folder containing encrypted files. The ransom message includes a short note for a victim that states that the data were encrypted and demands 0.18 in Bitcoin for recovering locked files. For contacting criminals, the victim is asked to use bakfiles@protonmail.com. However, there is little to none possibility of getting your files back by contacting people who already made your data useless.

Name FilesLocker ransomware
Also known as FilesL0cker RAN$OMWARE
Type Cryptovirus
File extension .locked
Ransom note

#解密我的文件#.txt

#DECRYPT MY FILES#.txt

Targets Chinese and English-speaking users
Contact email bakfiles@protonmail.com
Ransom amount 0.18 BTC
Distribution Spam email attachments
Elimination Use Reimage and fix virus damage after FilesLocker ransomware removal

FilesLocker ransomware has no difficulty to spread around the world because it has been set to use ransom notes written in English and Chinese languages.[2] The whole file encryption process is fairly quick because hackers use army-grate algorithms to lock files and make them useless. 

As a result, the victim cannot use photos, videos, documents, and even the whole network once the attack is finished. The only way to recognize the attack is to look at the file extension .locked appended at the end of each file name. However, paying the ransom is not the best solution since cybercriminals are not trustworthy. Unfortunately, security experts haven't released the official decryption tool as well.

The best way to release your data is to recover lost files from a backup. If you have your important files stored on cloud services or an external device, you can replace encoded data with the safe copies. However, you need to remove FilesLocker ransomware from the system first because ransomware can encrypt your newly-added files once again.

This virus is also known as FilesL0cker RAN$OMWARE. While its ransom message is typically placed on the system in both languages, we will provide the ransom note written in English: 

FilesL0cker RAN$OMWARE
########################################### 
All your important files(database,documents,images,videos,music,etc.)have been encrypted!and only we can decrypt!
To decrypt your files,follow these steps:
1.Buy 0.18 Bitcoin
2.Send 0.18 Bitcoin to the payment address
3.Email your ID to us,after verification,we will create a decryption tool for you.

Email:bakfiles@protonmail.com
Payment:3EZGS8P439PbBeiWjsGYjSSaRHn9CXKDRQ
Your ID: –

You need to get rid of the virus before attempting any data recovery. No matter how little the ransom amount looks, it is worth more than $1100 at the moment of writing. Keep in mind that FilesLocker ransomware is a product of hackers who have one goal – extorting money from their victims. We, like any other cybersecurity expert team,[3] recommend staying away from these dangerous people. 

If you got infected, make sure to perform FilesLocker ransomware removal using reputable anti-malware of your choice and then clean the system with system repair tools like Reimage. This is an important step because various intruders may affect the performance of your computer in different ways and programs like these can fix the system damage.

Also, when it comes to encrypted files and data encryption, you have the only solution – restore encoded data. You can find a few file recovery methods and software suggestions down below the article. Remember that ransomware is a dangerous cyber threat that tends to be persistent, so you may need to enter the Safe Mode before scanning the device. Follow our instructions and eliminate FilesLocker ransomware for good. 

Ransomware payload is hidden on spam email file attachments

The most common distribution technique used by malware creators is spam email campaigns. It is an easy way to spread viruses around the web and infect target devices without spending much time on social engineering. 

The email filled with ransomware may look legitimate and safe because it tries to pretend to belong to a known company or service. However, this is the method hackers use for tricking people. Users tend to believe the legitimacy of MS Word or Excel file received thru an email with the subject line “Financial information.” 

Pay more attention to what is said in the message and stay away from it if you spot these signs:

  • many typos or grammar mistakes;
  • not matching company names on the email and file attachment;
  • a sender is a service you are not using;
  • you cannot answer the email back;
  • file attachment is called “Order information” or “Invoice.”

Clean your email box more often, keep your anti-malware tools up-to-date and make sure that you are not installing any suspicious software on the device during installation processes. 

Terminate FilesLocker ransomware or any other malicious programs

When it comes to products from crypto extortionists, the main danger is the loss of all your data saved on the system. Because of this fact, you need to remove FilesLocker ransomware without wasting your time and postponing this procedure. Run a full system scan with your reputable anti-malware and get rid of infected files. If you haven't employed such a tool to keep your system safe, feel free to use one of our suggestions. 

Use Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes after FilesLocker ransomware removal and fix remaining virus damage or get rid of any malicious files or programs that may still affect the system of your computer and interfere with data recovery. After the double-checking, you can attempt file restoring using the method of your choice. Follow our methods step-by-step and get rid of the threat completely.

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove FilesLocker virus, follow these steps:

Remove FilesLocker using Safe Mode with Networking

Get rid of FilesLocker ransomware virus completely by entering the Safe Mode with Networking before a system scan:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove FilesLocker

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete FilesLocker removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove FilesLocker using System Restore

You may also try to restore the system to a previous state by enabling System restore feature:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of FilesLocker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that FilesLocker removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove FilesLocker from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by FilesLocker, you can use several methods to restore them:

Data Recovery Pro is an alternative method of file restoring if you have no backups

Since there is no decryption tool you are left with fewer file restoring methods, and we listed them for you.

You can recover accidentally deleted files,  encrypted data and files lost in other ways using Data Recovery Pro

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by FilesLocker ransomware;
  • Restore them.

Use Windows Previous Versions feature fo recover data after FilesLocker ransomware attack

This is a great file restoring feature for Windows users who haven't backed their data before. However, this is helpful if System restore was enabled before

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer is yet another data recovery method that helps people after FilesLocker ransomware infection

If Shadow Volume Copies remain untouched after the encryption process, you can use ShadowExplorer for data recovery

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Decryption is not available

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from FilesLocker and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Alice Woods
Alice Woods - Likes to teach users about virus prevention

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Alice Woods
About the company Esolutions

References

Removal guides in other languages