How to remove LoveLock ransomware virus

Yet another love-themed ransomware emerges: this time, it’s LoveLock ransomware

LoveLock virus is another proof that Valentine’s day gives cyber criminals^[1] a chance to use romantic tricks to deceive users and convince them to download malicious^[2] files to their computers. This Love day-themed ransomware virus reminds us of Love2Lock ransomware, because both of them are nasty data-encrypting computer programs which were developed with evil purposes only. Although it seems that LoveLock’s devs didn’t manage to finish their programming work on time, the virus can be improved shortly. However, malware researchers have noticed a spam email campaign^[3] going on, which delivers LoveLock malware to victims. 

As we have mentioned before, it was noticed that the virus is not completed yet, and the spam campaign spreading this ransomware is considerably small. We assume that criminals are testing the distribution techniques before they take serious actions. Currently, the virus encrypts files that have these file extensions: .aspx, .asp, .csv, .doc, .docx, .html, .jpg, .mdb, .odt, .xls, .xlsx, .xml, .php, .psd, .sln, .png, .ppt, .pptx, .sql, .txt. The list of target file extensions is considerably short, especially if compared with target lists of viruses like Cerber or Locky^[4], who aim to corrupt over 300 different file types. LoveLock ransomware follows ransomware-development traditions and adds a particular file extension to each file it corrupts. In case of this ransomware, .hasp file extensions are added. Following a successful encryption, the ransomware creates a .txt file, which contains only one word – text1. These details clearly show that this malicious program is in-development stage at the moment because criminals do not even leave any instructions regarding data decryption. So if you have been attacked by this incomplete version of LoveLock ransomware, we suggest deleting the virus ASAP. For LoveLock removal, follow instructions provided below and use a decent anti-malware program like FortectIntego or MalwarebytesMalwarebytes.

How did I get infected with this incomplete ransomware virus?

As we have said, ransomware crooks are likely to be testing ransomware distribution techniques^[5] and choosing what kind of email messages are the most effective when convincing the victim to open attached files. You could get this ransomware after opening a suspicious email letter and clicking on a link provided in the message or opening an attached file. Please, if you care about your computer’s safety, try to bypass ANY kind of content online that raises at least the slightest suspicion. Remember that scammers are ready to go that extra mile and recreate legitimate-looking phishing Amazon or Paypal messages, which help them to force victims to open attached files. If you have received a letter from these companies although you had no interaction with them before, better check sender’s email address before exploring contents of the attachments or the message itself. It is obvious that john-amazonsupport83947[@]protonmail.com doesn’t work at Amazon at all.

How can I remove LoveLock virus?

In case you suffer from LoveLock virus attack, and you want your files back, follow instructions that we provide. We listed these instructions below and also added some pictures to make them appear more clear. You must remove LoveLock ransomware precisely, and anti-malware or anti-spyware programs works best for that. However, you have to do some preparations and restart your PC in a certain mode before starting the LoveLock removal procedure. All information that you need to know is presented below.