How to remove LockOn ransomware virus

LockOn is another HiddenTear inspired virus

LockOn is a ransomware virus that was discovered at the beginning of October 2017. The virus is based on HiddenTear project^[1] and uses AES encryption algorithm to lock files on the targeted computer. Following data encryption, crypto-virus shows a program window with a ransom-demanding message.

The virus is written on Lockon Ransomware.exe file. However, it spreads as a [HOT][+18] CHECKER PORN.exe. It seems that people who are interested in adult-themed content might install malicious payload from torrents, file-sharing sites or P2P networks. However, other distribution methods might be used as well.

LockOn ransomware only aims at files that are located in C:\Users\Exploits\Desktop\test directory. When targeted documents, audio, video, image and other data are taken to the hostage, cyber-criminals inform users about the encryption. Judging from the ransom note, the virus aims at English and French^[2] computer users.

The ransom-demanding window shows the status of encrypted files and provides instructions how to buy and transfer Bitcoins. Victims are warned that other attempts to remove LockOn or try to restore data will end up with a complete destruction of the device. However, these talks are just a psychologic terror used for threatening people to follow the instructions.

However, doing that is not recommended. Nevertheless, criminals promise to provide decryption key which is supposed to unlock an infected computer; it may not be true. The LockOn virus is based on HiddenTear which is a decryptable ransomware.^[3] Therefore, its decryptor might help to restore files as well.

Therefore, after the attack, you should concentrate on LockOn removal and do not believe in threatening hackers’ warnings. For ransomware elimination, you will need to obtain a professional malware removal program, such as FortectIntego. Though, ransomware might modify Registry and affect various system processes in order to boot with system startup and prevent from elimination.

However, you can reboot the device to Safe Mode with Networking as shown in the instructions below and perform automatic elimination without any worries. Please, do not try to locate and remove malicious components from the system manually. It might be dangerous!

Important security measures to avoid ransomware attack

Developers of the ransomware often use several strategies to reach as much computer users as possible. LockOn authors are most likely aim at people who download adult-themed content from various online sources. However, downloading illegal movies, videos or similar entries is one of the biggest risks to install malware instead. Thus, rule number one – stay away from the illegal content.

Additionally, file-encrypting viruses might be distributed using one of these methods:

• malicious spam emails with infected links, buttons or attachments;
• exploit kits;
• malicious ads that might be placed on legit and potentially dangerous sites;
• weak RDP connections.

To avoid ransomware, you have to not only install powerful antivirus but watch your steps and clicks online. Therefore, never open unknown email attachments or click suspicious links. Also, keep all your software updated.

Terminate LockOn ransomware virus from the computer safely

The only safe way to remove LockOn from the device is to rely on reputable malware removal software. To ensure smooth elimination, you should reboot the computer to Safe Mode with Networking and then install FortectIntego, MalwarebytesMalwarebytes or your preferred anti-malware tool. But before running a full system scan, you should update the security software.

After LockOn removal, you can restore your files from backups. Additionally, you can try HiddenTear decryptor or other alternative methods that are presented at the end of the article.