LockerGoga ransomware: what it is and how to remove it
LockerGoga ransomware is a file locking virus that was initially discovered after attacks were launched against European companies, such as Altran Technologies in France. Most recently, malware attacked high-profile Norwegian aluminum manufacturer Norsk Hydro, stopping some production lines, crippling its IT systems across most business areas, and forcing the company to switch to manual operations instead.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Make sure nothing will rename more files to .locked: an automatic scan checks the PC first.
Do it yourself · free Remove LockerGoga ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
LockerGoga ransomware: summary
| Distribution | Spam email attachments, brute-force attacks |
|---|---|
| Name | LockerGoga ransomware |
| Type | Cryptovirus |
| First target | The French engineering consultancy Altran Technologies in January 2019 |
| Ransom note | README-NOW.txt |
| File extension | .locked |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 16 more facts
| Related files | hvwfcsky1377.bin, Kopya.exe, worker32, b3d3da12ca3b9efd042953caa6c3b8cd, tgytutrc7290.exe |
|---|---|
| SSL signatures | Alisa LTD, Sectigo RSA Code Signing CA, USERTrust Secure, Kitty's Ltd., Mikl Limited (all revoked) |
| Detected as | Win32:Trojan-gen Ransom.crysis Win32 / Filecoder.LockerGoga.A TR / Crypren.lydxc Trojan: Win32 / Occamy.C Ransom.Enciphered Etc. |
| Contact emails | CottleAkela@protonmail.com, QyavauZehyco1994@o2.pl, DharmaParrack@protonmail.com, wyattpettigrew8922555@mail.com |
| Encryption algorithm | RSA-1024 and AES-256 |
| Detection names | No Microsoft detection name is known |
| Encrypted file extension | .locked |
| Decryptor | No free decryptor is known for this variant; check No More Ransom (nomoreransom.org) for updates |
| Damage | Not recorded in the old report |
| Symptoms | Files renamed with a new extension and a ransom note left in folders |
| Evidence | 13 write-ups by security sites; no sample analysed yet |
| Encrypted files | .locked |
| Attacker contacts | CottleAkela@protonmail.com |
| Free decryptor | No free decryptor is known (checked 6 October 2026) |
| First seen | 25 March 2019 |
| Facts checked | 6 October 2026 |
- File extension:
.locked - Note file:
README-NOW.txt - Contact:
CottleAkela@protonmail.com
From our report of Mar 2019 · not reviewed since
More from our earlier report on LockerGoga ransomware
- Use for LockerGoga ransomware removal
- There was a significant flaw in the security system of your company.
- You should be thankful that the flaw was exploited by serious people and not some rookies.
- They would have damaged all of your data by mistake or for fun.
- Your files are encrypted with the strongest military algorithms RSA4096 and AES-256.
- Without our special decoder it is impossible to restore the data.
- Attempts to restore your data with third party software as Photorec, RannohDecryptor etc.
- will lead to irreversible destruction of your data.
- To confirm our honest intentions.
- Send us 2-3 different random files and you will get them decrypted.
- It can be from different computers on your network to be sure that our decoder decrypts everything.
- Sample files we unlock for free (files should not be related to any kind of backups).
- We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged.
- DO NOT RENAME the encrypted files.
- DO NOT MOVE the encrypted files.
- This may lead to the impossibility of recovery of the certain files.
- To get information on the price of the decoder contact us at: CottleAkela@protonmail.com;QyavauZehyco1994@o2.pl The payment has to be made in Bitcoins.
- The final price depends on how fast you contact us.
- As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security
- Additionally, some computer security programs such as AVG and Avast detect the virus as Win32:Trojan-gen.
- Each impacted system had three key elements: They all ran Microsoft Windows.
- Files, including some system files, had been encrypted.
- The network interface on every system had been disabled.
- The local user accounts on every system had their password changed.
- They all ran Microsoft Windows.
- It is mostly direct labor: some of the activities that we use computers to do, today we use manual labor.
- We have to add some more people.
- Hydro still does not have the full overview of the timeline towards normal operations, and it is still too early to estimate the exact operational and financial impact.
How LockerGoga ransomware behaves
From our report of Mar 2019 · not reviewed since
LockerGoga is a ransomware-type virus that recently attacked Norwegian aluminum producer Norsk Hydro and other companies
LockerGoga ransomware is a file locking virus that was initially discovered after attacks were launched against European companies, such as Altran Technologies in France.
Most recently, malware attacked high-profile Norwegian aluminum manufacturer Norsk Hydro, stopping some production lines, crippling its IT systems across most business areas, and forcing the company to switch to manual operations instead. LockerGoga ransomware works very similarly to any other crypto-viruses:
- locks up files using AES-256 + RSA-1024 encryption algorithms
- appends a file extension (in this case - .locked)
- drops a ransom-demanding message README-NOW.txt
To free the data held hostage, victims have to email hackers via CottleAkela@protonmail.com, QyavauZehyco1994@o2.pl, DharmaParrack@protonmail.com, wyattpettigrew8922555@mail.com, or other, and find out what amount of Bitcoin is required for the alleged decryptor. The price usually varies, depending on how fast the company contacts cybercriminals.
The malware also does a good job at evading detection, as the initial file is digitally signed (nevertheless, the certificates are now revoked). The malware was found changing victims' passwords and locking them out of the system. LockerGoga virus has similarities with such viruses like Everbe, GusCrypter, and Vurten.
The first instance of this Goga ransomware virus was discovered involved the malware attack on an engineering consultancy firm that released an official press release to protect their users' data. The company also shut down their network and applications because operations were already affected in some European countries due to this attack.
The victim of this LockerGoga ransomware, Altran Technologies revealed little information about the attack. Stephanie Bia stated in the press release:
Since LockerGoga ransomware virus is a cryptovirus, the main purpose is to encrypt files on the targeted system and then demand ransom for the alleged decryption. From the sample that has been analyzed "worker" and "worker32" are the processes this ransomware launches on the infected device.
The initial payload, however, often comes with files that are digitally signed by Alisa Ltd., Kitty's Ltd., or Mikl Limited. This technique can help LockerGoga virus to evade detection. Fortunately, the digital signatures have since then been invalidated.
Before engaging in any type of activities, LockerGoga ransomware makes sure that the attacked device is not a sandbox or a virtual machine. It was also spotted evading machine-learning kind of AV engines and sleeping over 100 times in some cases.
When the payload is launched LockerGoga ransomware starts with its encryption and uses army-grade encryption algorithms RSA-1024 and AES-256. Because the virus authors target large-scale organizations, the locked files are mainly document extensions, such as .doc, .pdf, .ppt, .xlm, .xlsx, .js, .pptx, .,db, etc. (31 document extensions in total).
According to research, the encryption process only takes a couple of minutes, as LockerGoga utilizes every CPU core to run the process as fast as possible.
After the enctyption process, LockerGoga ransomware drops a ransom note which reads:
LockerGoga ransomware developers encourage victims to contact them via CottleAkela@protonmail.com and QyavauZehyco1994@o2.pl, but you shouldn't do that since it may lead to permanent data and money loss. As many researchers advise, you need to terminate this virus and then focus on data recovery.
It is known that LockerGoga brings some malicious files together with it. Cybersecurity experts have discovered that the data is named hvwfcsky1377.bin - Kopya.exe, b3d3da12ca3b9efd042953caa6c3b8cd.
According to British security researcher Kevin Beaumont, LockerGoga did the following to the infected systems:
Nevertheless, this sample comes from the renowned Norsk Hyrdo attack, so the infection type might vary.
However, when it comes to LockerGoga ransomware removal from the network of a company, you need to employ experts, IT specialists and take the internet security seriously. Professional cyber security experts can determine the damage and possible fix issues with affected data. If you as an everyday user need similar help with your encrypted files, check our software suggestions below the article.
You need to remove LockerGoga ransomware using anti-malware tools like because this threat installs more files on the system and affects other parts of the device. You may also benefit from virus damage removal using or similar PC repair tools.
From our report of Mar 2019 · not reviewed since
Another high-profile LockerGoga target: Norsk Hydro
Located in Oslo, Norway, Norsk Hydro is the largest aluminum producer in the world, manufacturing almost half a million tons of the material a year.
The company is also known for its activity in other sectors like solar power technologies, hydropower, and oil industry.
The attack occurred on late Monday, January the 18th when Norsk Hydro IT staff noticed suspicious activity on the IT systems. Initially, and up till now, the company does not directly relate the compromise to LockerGaga ransomware, although Norsk Hydro CFO Eivind Kallevik did confirm that the attack is related to a file locking virus and that the situation is "quite severe."
Norsk Hydro is now forced to switch to manual handling of the operations, and the staff is told not to log in to any IT systems. The company immediately contacted third-party security forensics to assist with the situation, and are actively trying to recover from the attack. Many workers are asked to work multiple shifts to minimize the losses. Kallevik commented to Reuters:
According to him, the company is able to provide all the services and process all customer orders as usual, although it is not clear whether the future procedures will be affected, as the official website is down currently. Norsk Hydro is now focusing on continuing regular operations via manual methods, minimizing the financial and operational losses, and recovering the IT systems using backups.
Due to LockerGoga ransomware attack, the aluminum prices went up to record-high in the past three months, and the company's stock price went down by 3.4%, which later went back up by 0.8%.
The LockerGoga ransomware note
On the 24th of January 2019, Altran was the target of a cyber attack affecting operations in some European countries.
To protect our clients, employees and partners, we immediately shut down our IT network and all applications. The security of our clients and of data is and will always be our top priority. We have mobilized leading global third-party technical experts and forensics, and the investigation we have conducted with them has not identified any stolen data nor instances of a propagation of the incident to our clients.
Our recovery plan is unfolding as expected and our technical teams are fully mobilized.
Throughout the process, Altran has been in contact with its clients, relevant governmental authorities and regulators.
How to remove LockerGoga ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove LockerGoga ransomware and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Unplug the network cable or turn off Wi-Fi, and disconnect USB drives, external disks and network shares, so LockerGoga ransomware cannot reach more files. Pause OneDrive, Google Drive or Dropbox sync, because synced folders upload the encrypted copies over the good ones.
Leave the PC on but offline while you read the next steps, since a restart can let the ransomware run again. This applies to Windows 11 and Windows 10 alike.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Your files now end in
.lockedand the instructions are inREADME-NOW.txt. Save both to a USB stick, a copy of the note and two small encrypted files, before anything else.On another device, check them with ID Ransomware or Crypto Sheriff: the family name decides which decryptor, if any, can help. Keep the note's ID and contact line for your report.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
Our last check found that for LockerGoga ransomware, no free decryptor is known (checked 6 October 2026). Look again yourself in the No More Ransom list and the free decryptor pages of Emsisoft, Avast and Kaspersky, which add new families every year.
A decryptor needs the ransomware gone first, or it encrypts the files again. Keep at least one copy of the encrypted files on an external drive, even if no tool works yet.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Removing LockerGoga ransomware does not bring the files back, but it has to come first. Start with Defender's Full scan, then the offline scan from the same Scan options page, which checks the disk before Windows loads.
If the scan cannot start, use Safe Mode with Networking. Delete the ransom notes only after you have saved a copy, because removal tools sometimes leave them behind on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Windows keeps shadow copies for restore points and backups, and some ransomware fails to delete them.
vssadmin list shadowsin an administrator Command Prompt tells you at once whether any exist.If they do, right-click the folder that held your files, open Properties > Previous Versions, select a version from before the attack, and click Open to check it before you Restore or copy the files out. Windows 11 and Windows 10 both have the tab.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
A backup made before the attack is the surest way back. Connect it only once the PC is clean, then restore from File History, Windows Backup, OneDrive's Restore your OneDrive or your own external copies.
Without a backup, try file recovery: the originals that LockerGoga ransomware deleted may still be on the disk until something overwrites them. Install nothing new on the drive you want to recover from on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Mar 2019 · not reviewed since
Update: Norsk Hydro is recovering from the attack with the help of such sources like Microsoft
Later in March, MalwareHunterTeam discovered a new sample of LockerGoga which was also uploaded from Norway, so security team believes that it was used in the Norsk Hydro attack.
This variant of the virus uses new contact details - DharmaParrack@protonmail.com and wyattpettigrew8922555@mail.com.
The company published a press release announcement that explains the situation further. According to Norsk Hydro, it is recovering from the attack with the help of external parties, such as Microsoft, and are not planning on paying ransom to LockerGoga authors. Instead, the company is focusing on recovering all the crucial data from backups.
Most of the company's procedures are running as usual, although some employees are still forced to perform some manual operations. By far the biggest downfall of the attack was that the company could not access a full list of customer orders, as stated in the press conference release by Chief Financial Officer Eivind Kallevik on Thursday.
Despite promising leads, Norsk Hydro did not detail anything further:
Despite that, based on the samples published on Virus Total and insight from multiple security researchers, it is clear that hackers managed to break-in to the company's networks and then gained access to Active Directory server. From there, the attackers spread LockerGoga ransomware laterally, as the virus does not have the capability of propagating itself on the network.
After encrypting files, LockerGoga disabled hardware (network cards) from working and also changed passwords of every account, preventing anybody from accessing their workstations. This scheme is performed in order to slow down the recovery operations, as each PC needs to be taken care of separately, instead of uploading backups from a cloud service.
According to research from Cisco Talos team, LockerGoga is much closer to a destructive type of malware - wiper, rather than ransomware. Nevertheless, it is just a theory, and the real goals of hackers are only known by them.
From our report of Mar 2019 · not reviewed since
Email box may get filled with infected emails
Spam email campaigns grow to a new level when emails may even go to your regular email box directly and look legitimate and safe because malicious actors use names like DHL, FedEx, Amazon or PayPal to make the impression of legitimacy.
When you receive an email, you were not expecting to get make sure to pay more attention to details. Often subject lines like Invoice or Order information tell about the questionable content of the email, especially when the name of a service is not familiar.
You should delete suspicious emails and avoid opening files attached because documents or PDF files can contain malicious macros or even direct payload. This is the main distribution technique when it comes to crypto malware like miners or ransomware.
From our report of Mar 2019 · not reviewed since
Eliminate LockerGoga ransomware and check if the system is clear before other steps
We can understand that LockerGoga ransomware virus is a severe threat and file encryption is the primary concern of yours.
However, we cannot stress enough how important it is to terminate all related processes and clean the device entirely before focusing on anything else.
Remove LockerGoga ransomware using anti-malware tools like , or and scan the device fully so that all virus damage can be fixed. You can use a few tools and scan the system a few times to double-check because ransomware is a persistent cyber threat.
When the LockerGoga ransomware removal is done, you can proceed with data recovery options. The best solution for this should be data backups on the external device. However, not everyone has up-to-date backups. For this reason, we have a few suggestions of software and features on your computer that may help in file recovery.
[GI=method-1]Try rebooting the device in the Safe Mode with Networking before a thorough system scan:
[GI=method-2]Get rid of LockerGoga ransomware using System Restore feature on your PC:
Windows Previous Versions feature helps in file recovery
Try Windows Previous Versions feature as an alternative to file backups
You can use ShadowExplorer
It seems that LockerGoga ransomware is not affecting Shadow Volume Copies. If so, you can restore data with ShadowExplorer
Decryption is not available
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
Backups: the 3-2-1 rule
Keep three copies of files that matter, on two kinds of storage, with one copy offline or off-site.
A disk that stays plugged in is reached by malware like LockerGoga ransomware together with the PC; one you connect only for the backup is not.
On Windows 11, File History keeps versions on an external drive, and OneDrive keeps earlier versions of synced files. Before restoring anything, make sure the PC no longer shows files that end in .locked and no longer open.
Setting it up step by step: 3-2-1 backups on Windows 11 and 10.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
Questions about LockerGoga ransomware
How do I open .locked files?
You cannot open them by renaming or by choosing another program. The .locked ending shows that LockerGoga ransomware encrypted the content, and only the matching key can reverse it. Renaming a file back to .docx or .jpg changes nothing except the icon, and it can confuse a future decryptor, so leave the names as they are.
To get the content back, use a backup, an unencrypted copy elsewhere, or a decryptor listed on No More Ransom if one exists for LockerGoga ransomware. Store the encrypted files on an external disk until then.
How did LockerGoga ransomware get on my computer?
The way LockerGoga ransomware spreads has not been documented yet, so look at your own recent activity. On home PCs, ransomware most often comes with cracked programs, game cheats, key generators and fake updates, or with an e-mail attachment that was opened. On business networks, attackers usually log in through Remote Desktop with a stolen or guessed password.
Think back to what was downloaded or installed in the days before files that end in .locked and no longer open, and check the Downloads folder and Installed apps sorted by date. Keep anything suspicious for your report, but do not run it again.
Should I pay the ransom?
We advise against it, and so do the FBI, Europol and national cyber agencies. Payment does not guarantee a working tool: some attackers never reply, some tools damage files, and some variants have no decryptor at all. Paying also funds further attacks and can make you a target again.
Before considering payment, try every recovery option in this guide and report the attack. Companies must involve their legal adviser and insurer, because payments to sanctioned groups can be illegal. If files are truly irreplaceable, store the encrypted copies and wait; decryptors sometimes appear later.
Is there a free LockerGoga ransomware decryptor?
We last checked on 6 October 2026, and for LockerGoga ransomware no free decryptor is known. We check No More Ransom, which collects free tools from police and security companies, and the decryptor pages of the major antivirus vendors. A working decryptor exists only when the encryption has a flaw or the keys were leaked or seized.
Ignore sites and videos that offer a "LockerGoga ransomware decryptor" for download or for a fee: these are usually scams or malware. Real decryptors are free and come from known security companies or law enforcement. Keep the encrypted files in case a tool appears later.
Can a data-recovery company decrypt my files for a fee?
Only if a decryptor already exists or the company pays the attackers for you. Some "ransomware recovery" services advertise that they can decrypt families with no known flaw; in practice they negotiate with the attackers and add their own fee. Others use the same free tools listed on No More Ransom.
Before you hire anyone, ask in writing how they will recover the files, whether they will contact the attackers and what happens if they fail. A legitimate service answers clearly. If a free decryptor exists for your family, you can run it yourself.
Did LockerGoga ransomware steal my files or passwords?
We do not know yet. Nothing published so far shows data theft by LockerGoga ransomware, but the only confirmed sign is files that end in .locked and no longer open, which says nothing about what happened before. Many current ransomware attacks copy files or run a password stealer first, so it is wise to act as if they did.
From a clean device, change the passwords that were saved in the browsers on this PC, starting with e-mail and banking, sign out of all sessions and turn on two-step verification. Watch bank statements and account activity for the next few weeks.
Is LockerGoga ransomware the same as other ransomware with a similar name?
Not necessarily. Ransomware names come from the file extension, the note or a word in the code, so unrelated families often end up with similar names, and one family can appear under several names. The difference matters: a decryptor or advice for one family does not fit another and can damage files.
Compare the ending added to your files and the exact name of the note with the summary table at the top of this guide, then upload the note and one encrypted file to ID Ransomware from a clean device. If the result names another family, follow the guide for that family instead.
Can I just remove .locked from the file names?
You can try it on a copy, but for real ransomware it will not help. The .locked extension is only a label; the file content has been scrambled with a key the attackers hold.
If a renamed copy opens normally, the malware only renamed files, which happens with some fake ransomware, and you can rename the rest back. If it does not open, leave the files as they are. Renaming encrypted files can confuse a decryptor later, so always work on copies.
Can I delete README-NOW.txt?
Yes, the note itself is harmless text and deleting it does not affect your files. Keep at least one copy first, outside the infected PC. README-NOW.txt contains your personal ID and the attackers' contact details, which identification services use to tell which family encrypted your files, and which a decryptor may need later.
Police reports also ask for it. Once you have saved a copy, you can remove the notes from every folder after the ransomware program has been removed and your files are restored or backed up.
Will Fortect remove LockerGoga ransomware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For LockerGoga ransomware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Oslo Bors: Norsk Hydro: Hydro subject to cyber-attack (read October 6, 2026)
- Globenewswire: Information on a cyber attack (read October 6, 2026)
- Trend Micro: What You Need to Know About the LockerGoga Ransomware (read October 6, 2026)
- Lesvirus: Lesvirus (read October 6, 2026)
- Doublepulsar: How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business (read October 6, 2026)
- Talos Intelligence: Ransomware or Wiper? LockerGoga Straddles the Line (read October 6, 2026)