LooCipher ransomware (Free Instructions) - Removal Guide

LooCipher virus Removal Guide

What is LooCipher ransomware?

LooCipher ransomware is the virus that encrypts all the data on the infected computer and appends the .lcphr extension to those files

LooCipher ransomware LooCipher ransomware is the virus that demands payment from victims to make a profit.

LooCipher ransomware is the cryptovirus that demands 300 euro in Bitcoins that is equivalent to $330. The demand shows up on the ransom note that gets delivered once all the chosen files get encrypted and marked with the .lcphr appendix. According to the initial ransomware discovery, this threat spreads using spam campaigns, during which the malicious Word document called Info_BSV_2019.docm gets downloaded on the system and once the embedded macros get enabled machine gets infected with crypto malware.[1]

Macros get triggered when the victim wants to see the contents of this file, and Tor server connection starts to download the executable file with LooCipher ransomware virus payload. Additional data get installed by the virus to ensure that decryption and removal processes are complicated as they can get, so researchers have a hard time to fight this crypto-extortion based malware.

Name LooCipher ransomware
Type Cryptovirus
File extension .lcphr
Ransom amount $330
Preferred cryptocurrency Bitcoin
Ransom note @Please_Read_Me.txt, pop-up window message
Distribution Spam campaign distributing maliciously infected files, other malware
Added files on the infected system Info_Project_BSV_2019.docm; c2056.ini, LooCipher_wallpaper.bmp, LooCipher.exe, output.135379688.txt, output.135371487.txt
Possible damage Encrypted files may get damaged permanently, additional info-stealing malware installed on the machine, system settings altered and files deleted
Elimination Get FortectIntego for LooCipher ransomware removal and general system cleaning

The first thing that is known about LooCipher ransomware virus is the initial process that makes users' files locked and unopenable – encryption.[2] This particular virus uses the AES algorithm for the process and makes data useless by changing the original code of documents, photos, videos, archives, or even databases.

It does not delete the original files it only leaves them as zero-bytes copies on the system and marks the other files with .lcphr extension. Then LooCipher ransomware can also add other data on the machine to ensure that the machine is not working correctly and disable security functions or install programs to make the device slow.

LooCipher cryptovirusLooCipher cryptovirus is the ransom-demanding cyber infection that asks for $330 worth of Bitcoin.

Also, LooCipher ransomware can add particular registry keys, delete Shadow Volume Copies and so on, so there is no easy way to terminate this threat and to recover files encrypted by the malware. Cybercriminals developed this program so there might be additional functions that ransomware runs on the affected machine to ensure the persistence.

Due to the files and programs that LooCipher ransomware additionally installs and runs on the computer, people affected by the threat cannot use the machine normally after the infiltration. In most cases, antivirus tools or security programs get disabled by the cryptovirus itself. Due to this fact, we offer to reboot the machine in Safe Mode before eliminating this virus.

However, you cannot notice the particular program that can be deleted since LooCipher ransomware is not a program visible on the system. You can only experience difficulties while working with the device or the slowness of the processes. The first symptom is @Please_Read_Me.txt – ransom note delivery. You can see the illustration with the contents of the ransom note.

LooCipher ransomware ransom noteLooCipher ransomware asks for a hefty amount in Bitcoin from the victim in the ransom note text file.

LooCipher ransomware creators state all the needed information in this file that contains answers to most important questions and the particular amount of the ransom that the victim is encouraged to pay for the decryption key. Unfortunately, there is no guarantee that your files can be recovered, even when the payment of $330 in Bitcoin is made.

Besides the ransom note, LooCipher ransomware changes the Desktop wallpaper and adds its own picture on the background. In this message, developers also have listed the facts about encryption, payment, and alleged file recovery.

Experts[3] note how important it is to stay away from LooCipher ransomware developers and to keep contact with them. You need to avoid clicking on anything they display in the screen or any links and files. You can lose money or files permanently if you do so without thinking.

Unfortunately, LooCipher ransomware creators start the countdown once the ransom message gets delivered and waits for the payment from the victim in five days or less. Allegedly your already useless files may get deleted permanently as well as the decryption key after that.

LooCipher ransomware cryptovirusLooCipher is the threat that encrypts data and marks those files using .lcphr extension.

Don't believe these criminals and remove LooCipher ransomware as soon as you get the ransom note delivered on the screen. Stay away from any contact and paying the demanded amount and rely on automatic anti-malware tools that can scan the machine of yours and terminate possible threats.

You can see the countdown on the program window named LooCipher that also includes all the information about payment address and so on. However, this is not the best way to recover encoded data. You should get one of the tools that can detect LooCipher ransomware virus and terminate the malware.[4]

For the LooCipher ransomware removal, we recommend a reliable anti-malware program and full system scan. Then you can try file recovery methods. The best one is to use the data backed up on an external drive or database. Also, we have a few software offers down below.

LooCipher ransomware virusLooCipher ransomware is the threat that delivers various messages on the screen with information about the ransom payment methods and encryption.

Phishing campaign distributes malicious documents

Malicious spam campaign is used for spreading this malicious malware, and it involves a particular Word file filled with macros that need to be triggered. This is achieved by adding the message to the file that states about enabling macros for the content viewing. Unfortunately, people do so and trigger the drop of infectious file.

This is common for such spam email campaigns and ransomware distributions.[5] When macros get enabled the connection to a Tor server gets made, and the download of the executable starts. Then the file will be renamed to LooCipher.exe and launched. Various other data get added on the system during these processes, so the virus keeps on running.

The email itself that contains such infected files can appear legitimate and harmless, but the data itself hides all the danger. In most cases, such campaigns involve well-known names of companies, services. When you receive DHL, FedEx, eBay notification with possibly financial information and file attachments, keep away from the file if you don't use the service at the time.

Eliminate LooCipher ransomware virus with all the added files and programs

You should note that LooCipher cryptovirus disables various functions and applications to ensure that the victim cannot delete this threat from the machine quickly. All the files and programs cannot be found manually since there is a lot of places virus may hide its parts.

Get the automatic anti-malware tool and run the system scan to remove LooCipher ransomware completely. This program can check the machine for corrupted files, malicious data, malware, and other intruders. All issues with the computer can get fixed during one process.

Tools like FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes can ensure the best LooCipher ransomware removal results because such programs can also fix errors and issues with the operating system, recover the settings and all the virus damage.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of LooCipher virus. Follow these steps

Manual removal using Safe Mode

Remove LooCipher ransomware by rebooting the machine in Safe Mode and scanning the PC with antivirus tool. This method allows terminating the threat completely

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):


After you are finished, reboot the PC in normal mode.

Remove LooCipher using System Restore

You may benefit from System Restore feature as the method of computer cleaning and virus elimination

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of LooCipher. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that LooCipher removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove LooCipher from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by LooCipher, you can use several methods to restore them:

Data Recovery Pro is the tool useful for file restoring

You can rely on Data Recovery Pro when files get encrypted or you accidentally deleted them from the PC

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by LooCipher ransomware;
  • Restore them.

Windows Previous Versions is the feature for data recovery

You can get back files affected by LooCipher ransomware virus with Windows Previous versions if you enabled System Restore before

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer is the alternate file restoring method

When LooCipher ransomware leaves Shadow Volume Copies untouched, you can recover those files with ShadowExplorer

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

There is no decryption tool for the LooCipher ransomware virus

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from LooCipher and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting ransomware

Choose a proper web browser and improve your safety with a VPN tool

Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.


Lost your files? Use data recovery software

While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.

To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.

About the author
Linas Kiguolis
Linas Kiguolis - Expert in social media

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Linas Kiguolis
About the company Esolutions