Severity scale:  
  (97/100)

RandomLocker ransomware. How to remove? (Uninstall guide)

removal by Ugnius Kiguolis - - | Type: Ransomware

RandomLocker ransomware that demands to pay 10 USD in 24 hours

RandomLocker ransomware

RandomLocker is yet another ransomware virus that has emerged at the end of April 2018. It functions as a file-encrypting virus, which adds .rand file extension to locked files and replaces desktop's wallpaper with an “Ooops, your files have been encrypted!” screen. The new background image informs about encrypted data and demands the victim to contact randomlocker@tuta.io email address. The ransom RandomLocker is not high – 10 USD that have to be paid within 24 hours in Bitcoins.

RandomLocker
Type Ransomware
Extension used .rand
Email address randomlocker@tuta.io
Ransom note “Ooops, your files have been encrypted!”desktop picutre
Distribution Spam, rogue software, EK, RDP
Decryptor available No
Removal possibilities Automatic only. Download Reimage and run a full scan

The RandomLocker ransomware uses AES encryption algorithm[1] and demands payment in Bitcoins. Since the ransom required is equal to 10 USD concerted to Bitcoins, the virus may be claimed to be the lowest ransom demanding crypto-extortionist.

The smaller the ransom, the bigger the possibility is to make hundreds or thousands of people of paying it. That's a trick people should not fall for. It's very likely that the RandomLocker virus may be under the development phase or test its capabilities. Therefore, the more ransom it collects, the more attacks it may further initiate. Besides, the price or redemption is not very likely to decrease.

According to ransomware researchers, this malware is being distributed manually, i.e., no bots applied to spread it via malspam or other social engineering techniques, at least yet. However, the ransomware is very likely to be under the development, that's why it may switch manual distribution to Exploit Kits, rogue software updates, spam, and other techniques upon finishing the development.

As soon as the RandomLocker malware gets inside, it unravels the payload called ransomware.exe. The latter starts running in the background and scanning for the targeted files. Each of them is then encrypted using AES 256 cipher and feature .rand file extension.

The new background image informs the victim about encrypted data and provides the contact email address, which is randomlocker@tuta.io. The full RandomLocker background image says:

Ooops, your files have been encrypted!

Encryption was produced using the unique key generated by this computer.
To decrypt files, you need to obtain the private key.
The single copy of the private key, with will allow you to decrypt the files, is located on a secret server on the internet;

The server will destroy the key within 24 hours after encryption completed.
Payment has to be made within 24 hours
To retrieve the private key, you need to pay 10$ in BTC

Bitcoins have to be sent to this address: 3GPg3tgwZakR5uTELzjMJRj1NarxHH9YdJ
After you've sent the payment, send us an email to randomlocker@tuta.io with subject: UNLOCK ***
If you are not familiar with bitcoin you can buy it from here:
SITE: www localbitcoin.com
After we confirm the payment, we will send the private key so you can decrypt your system.

FILES DELETED IN
01:58:24
About Bitcoin
How to buy bitcoins?
Show Encrypted Files
Contact Us
[***] [Decrypt]

This crypto-ransomware demands a redemption in Bitcoins,[2] based on the current Bitcoin price, the victim should pay 0.0011 BTC (10 USD). Despite the fact that probably each computer user has such a sum of money in the wallet all the time, do not rush to give it away. Instead, we recommend you to remove RandomLocker virus with Reimage or Malwarebytes MalwarebytesCombo Cleaner.
There's no guarantee that criminals won't leave you without a decryptor after paying the ransom. Even worse, they can send you an infected decryptor, which may turn out to be spyware or worm. Therefore, take care of the RandomLocker removal asap.

At the moment of writing, only 19 AV engines out of 67[3] can detect and remove RandomLocker malware. Therefore, make sure to select a reliable security tool and run scan only after the update.

Ransomware developers prefer hacking unprotected RDPs

Ransomware distribution techniques are more or less clear. However, the trends a slightly shifting. While earlier crooks relied on spam and rogue software in particular, currently the's more and more instances registered when hackers exploit unprotected RDP (Remote Desktop Programs) that are connected directly to the Internet instead of using VPN.

Once the security flaw is found, the RDP password is modified allowing the attacker to inject ransomware into the targeted machine. Therefore, if you are using RDP, make sure to protect it using a reliable VPN service.

However, malicious spam email attachments are still being considered as the most frequently used virus distribution technique. To protect yourself from malicious attachments, bypass each suspicious email, which does not have the subject, the sender is unknown, though the attachment is named as “Urgent.”

Eliminate RandomLocker ransomware virus with one click

RandomLocker removal is a complicated process that can only be performed by a professional anti-virus, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes. Dievire.de[4] team stresses the fact that only security tool can delete programs and files that are related to the malware or compromised by it.

Once you remove RandomLocker, you can download a third-party data recovery tool and run a full system scan with it. If it cannot recover some files, you'll be able to exploit Volume Shadow Copies or use previous versions.

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove RandomLocker virus, follow these steps:

Remove RandomLocker using Safe Mode with Networking

Ransomware can block anti-virus programs. They may run scripts to automatically close security programs, which is why you may not be allowed to run a scan with the software you are using, as well as download a new program. To fix that, restart your PC into Safe Mode with Networking.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove RandomLocker

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete RandomLocker removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove RandomLocker using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of RandomLocker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that RandomLocker removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove RandomLocker from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

Despite the fact that hackers demand a ransom and intimidates victims that any attempt to unlock files without paying the redemption will cause permanent data loss, do not pay the ransom. There are quite a few ways to decrypt files encrypted by RandomLocker virus, so you'd better try them. 

If your files are encrypted by RandomLocker, you can use several methods to restore them:

Download Data Recovery Pro

Data Recovery Pro is a professional program that can recover the files when they are lost due to deletion, crash or corruption. Download the software and run a scan with it. 

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by RandomLocker ransomware;
  • Restore them.

Use Previous Windows version

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Exploit Volume Shadow Copies

Volume Shadow Copies are the copies of each file on Windows, including both technical and personal. Windows creates them by default, so you have many chances to retrieve them. Download Shadow Explorer and run a scan with it. In case it found nothing, it means that the ransomware deleted all of them. 

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

No RandomLocker decryptor

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from RandomLocker and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Ugnius Kiguolis
About the company Esolutions

References