RandomLocker ransomware (Removal Instructions) - Bonus: Decryption Steps
RandomLocker virus Removal Guide
What is RandomLocker ransomware?
RandomLocker ransomware that demands to pay 10 USD in 24 hours
RandomLocker is yet another ransomware virus that has emerged at the end of April 2018. It functions as a file-encrypting virus, which adds .rand file extension to locked files and replaces desktop's wallpaper with an “Ooops, your files have been encrypted!” screen. The new background image informs about encrypted data and demands the victim to contact randomlocker@tuta.io email address. The ransom RandomLocker is not high – 10 USD that have to be paid within 24 hours in Bitcoins.
| RandomLocker | |
|---|---|
| Type | Ransomware |
| Extension used | .rand |
| Email address | randomlocker@tuta.io |
| Ransom note | “Ooops, your files have been encrypted!”desktop picutre |
| Distribution | Spam, rogue software, EK, RDP |
| Decryptor available | No |
| Removal possibilities | Automatic only. Download FortectIntego and run a full scan |
The RandomLocker ransomware uses AES encryption algorithm[1] and demands payment in Bitcoins. Since the ransom required is equal to 10 USD concerted to Bitcoins, the virus may be claimed to be the lowest ransom demanding crypto-extortionist.
The smaller the ransom, the bigger the possibility is to make hundreds or thousands of people of paying it. That's a trick people should not fall for. It's very likely that the RandomLocker virus may be under the development phase or test its capabilities. Therefore, the more ransom it collects, the more attacks it may further initiate. Besides, the price or redemption is not very likely to decrease.
According to ransomware researchers, this malware is being distributed manually, i.e., no bots applied to spread it via malspam or other social engineering techniques, at least yet. However, the ransomware is very likely to be under the development, that's why it may switch manual distribution to Exploit Kits, rogue software updates, spam, and other techniques upon finishing the development.
As soon as the RandomLocker malware gets inside, it unravels the payload called ransomware.exe. The latter starts running in the background and scanning for the targeted files. Each of them is then encrypted using AES 256 cipher and feature .rand file extension.
The new background image informs the victim about encrypted data and provides the contact email address, which is randomlocker@tuta.io. The full RandomLocker background image says:
Ooops, your files have been encrypted!
Encryption was produced using the unique key generated by this computer.
To decrypt files, you need to obtain the private key.
The single copy of the private key, with will allow you to decrypt the files, is located on a secret server on the internet;The server will destroy the key within 24 hours after encryption completed.
Payment has to be made within 24 hours
To retrieve the private key, you need to pay 10$ in BTCBitcoins have to be sent to this address: 3GPg3tgwZakR5uTELzjMJRj1NarxHH9YdJ
After you've sent the payment, send us an email to randomlocker@tuta.io with subject: UNLOCK ***
If you are not familiar with bitcoin you can buy it from here:
SITE: www localbitcoin.com
After we confirm the payment, we will send the private key so you can decrypt your system.
—
FILES DELETED IN
01:58:24
About Bitcoin
How to buy bitcoins?
Show Encrypted Files
Contact Us
[***] [Decrypt]
This crypto-ransomware demands a redemption in Bitcoins,[2] based on the current Bitcoin price, the victim should pay 0.0011 BTC (10 USD). Despite the fact that probably each computer user has such a sum of money in the wallet all the time, do not rush to give it away. Instead, we recommend you to remove RandomLocker virus with FortectIntego or SpyHunter 5Combo Cleaner.
There's no guarantee that criminals won't leave you without a decryptor after paying the ransom. Even worse, they can send you an infected decryptor, which may turn out to be spyware or worm. Therefore, take care of the RandomLocker removal asap.
At the moment of writing, only 19 AV engines out of 67[3] can detect and remove RandomLocker malware. Therefore, make sure to select a reliable security tool and run scan only after the update.
Ransomware developers prefer hacking unprotected RDPs
Ransomware distribution techniques are more or less clear. However, the trends a slightly shifting. While earlier crooks relied on spam and rogue software in particular, currently the's more and more instances registered when hackers exploit unprotected RDP (Remote Desktop Programs) that are connected directly to the Internet instead of using VPN.
Once the security flaw is found, the RDP password is modified allowing the attacker to inject ransomware into the targeted machine. Therefore, if you are using RDP, make sure to protect it using a reliable VPN service.
However, malicious spam email attachments are still being considered as the most frequently used virus distribution technique. To protect yourself from malicious attachments, bypass each suspicious email, which does not have the subject, the sender is unknown, though the attachment is named as “Urgent.”
Eliminate RandomLocker ransomware virus with one click
RandomLocker removal is a complicated process that can only be performed by a professional anti-virus, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes. Dievire.de[4] team stresses the fact that only security tool can delete programs and files that are related to the malware or compromised by it.
Once you remove RandomLocker, you can download a third-party data recovery tool and run a full system scan with it. If it cannot recover some files, you'll be able to exploit Volume Shadow Copies or use previous versions.
Getting rid of RandomLocker virus. Follow these steps
Manual removal using Safe Mode
Ransomware can block anti-virus programs. They may run scripts to automatically close security programs, which is why you may not be allowed to run a scan with the software you are using, as well as download a new program. To fix that, restart your PC into Safe Mode with Networking.
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove RandomLocker using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of RandomLocker. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove RandomLocker from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.Despite the fact that hackers demand a ransom and intimidates victims that any attempt to unlock files without paying the redemption will cause permanent data loss, do not pay the ransom. There are quite a few ways to decrypt files encrypted by RandomLocker virus, so you'd better try them.
If your files are encrypted by RandomLocker, you can use several methods to restore them:
Download Data Recovery Pro
Data Recovery Pro is a professional program that can recover the files when they are lost due to deletion, crash or corruption. Download the software and run a scan with it.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by RandomLocker ransomware;
- Restore them.
Use Previous Windows version
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Exploit Volume Shadow Copies
Volume Shadow Copies are the copies of each file on Windows, including both technical and personal. Windows creates them by default, so you have many chances to retrieve them. Download Shadow Explorer and run a scan with it. In case it found nothing, it means that the ransomware deleted all of them.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
No RandomLocker decryptor
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from RandomLocker and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Natasha Aidinyantz. A Glossary of Cryptographic Algorithms. GlabalSign. Identity services company providing cloud-based, highly scalable PKI solutions for enterprises .
- ^ Danny Palmer. Ransomware: Why the crooks are ditching bitcoin and where they are going next. ZDNet. 24/7 news coverage and insights.
- ^ Ransomware.exe. VirusTotal. A free service that analyzes suspicious files and URLs.
- ^ Dieviren. Dieviren. German cybersecurity news, virus description, removal instructions.