Locky is a virus that pop-ups a warning on your computer screen and asks to pay certain amount to decrypt all locked files. Locky is a detection name for a malware that locks the PC and encrypts files in it. Then, it will assign a private key that is needed to decrypt all files.
Locky infection is often called as ransomware by security experts. It may display deceptive message stating that anything you do to remove the virus may lead to the destruction of your private key. Without this key, decrypting your files will be impossible.
Computer users should know that Locky and most of its kind were developed by online criminals to earn profit through fraudulent act. Normally, ransomware are programs that will block access to files, programs, and computer in order to collect payment from victims. Sending money to this kind of attacker is similarly giving them chance to earn easy profit via online scam. Hence, this activity will never stop. Other malware developers seeing success through this scheme may carry out the same attack soon.
In order to stop the ransomware activity including Locky virus, it is best to remove the threat, virus, or malware that dropped it into the computer. Next, you need to deal with the encrypted files using valid tools from known security provider. One of the mentioned tools we utilized on the removal guide on this page may help unlock files that were encrypted by Locky malware.
Follow these Procedures to Remove Locky
Ransom Trojans and viruses will lock the screen and makes the computer unusable. Common ways to deal with this type of infection is to boot the PC using another device. For this tutorial we will do a bootable disk that contains Locky remover.
Create a USB Bootable Device
1. Download Kaspersky Rescue Disk from their official server. Click the button below. The file will be in .ISO format.
2. Download this utility called rescue2usb to record your .ISO file into the USB drive. Obviously you need a USB thumb drive at least 512MB in capacity. Plug it to the computer.
3. Once you have the two programs, double-click on the rescue2usb.exe to start creating a bootable USB drive.
4. You will see on the screen in the program called Kasperksy USB Rescue Disk Maker. Click on Browse and locate the .ISO file.
5. Under USB Medium, select the proper drive of your USB device.
6. Click on START. It will now begin to create a bootable USB drive with Kaspersky Rescue Disk in it.
4. You will see on the screen in the program called Kasperksy USB Rescue Disk Maker. Click on Browse and locate the .ISO file.
5. Under USB Medium, select the proper drive of your USB device.
6. Click on START. It will now begin to create a bootable USB drive with Kaspersky Rescue Disk in it.
Start the Computer with Kaspersky Rescue Disk.
1. You must set the computer to use other bootable device aside from hard drive. For this procedure, enable your BIOS to boot to USB device. If you are not familiar with this, please refer to your computer's instruction manual.
2. Another option is to access the Boot Menu right after you turn one the PC. It will present a Menu so that you can select a preferred boot drive. Select Removable Devices.
3. Your computer will now start and load Kaspersky Rescue Disk.
4. If you see a message on the screen, please Press any key to enter the menu. You only have 10 seconds to do this, otherwise it will boot with the hard drive.
4. If you see a message on the screen, please Press any key to enter the menu. You only have 10 seconds to do this, otherwise it will boot with the hard drive.
5. Next screen will be the interface language. Please select desired language to use.
6. You must run the program in Graphic Mode. This gives you easy access to all commands and menus.
7. End User License Agreement will appear. Please accept to continue using the program. Press 1 to proceed.
6. You must run the program in Graphic Mode. This gives you easy access to all commands and menus.
7. End User License Agreement will appear. Please accept to continue using the program. Press 1 to proceed.
Using WindowsUnlocker to Remove Locky
1.Click on the K button at the lower left corner of the screen.
2. Select Terminal on the list. It will open a command prompt.
3. Type windowsunlocker and press Enter on your keyboard.
3. Type windowsunlocker and press Enter on your keyboard.
4. On WindowsUnlocker menu, please type 1 to Unlock Windows. This utility will clean the registry for malicious entries.
5. After the cleanup process, it will display the menu once more.
6. Press 0 on your keyboard to exit WindowsUnlocker.
6. Press 0 on your keyboard to exit WindowsUnlocker.
Run a Virus Scan
1. After removing Locky, you need to delete all remaining components.
2. Click on the K to display the menu.
2. Click on the K to display the menu.
3. Select Kaspersky Rescue Disk. This will open the virus scanning tool.
4. You need to update the program first. Select My Update Center tab and click on Start update. This requires an Internet connection.
4. You need to update the program first. Select My Update Center tab and click on Start update. This requires an Internet connection.
5. After updating the program, select Object Scan tab and click on Start Object Scan. You must scan the following:
- Disk boot sectors
- Hidden startup objects
- All drives
6. Scanning the entire hard drive may take some time. Please let the scan to finish.
7. Once the scan process is complete, the tool will prompt you for preferred actions on detected threats. Deleting all threats is recommended.
8. You can now turn off the computer, unplug the USB drive, and start Windows in normal mode.
7. Once the scan process is complete, the tool will prompt you for preferred actions on detected threats. Deleting all threats is recommended.
8. You can now turn off the computer, unplug the USB drive, and start Windows in normal mode.
How to Decrypt Files Affected by Locky
1. Download the tool from this link:
ftp://ftp.drweb.com/pub/drweb/tools/te94decrypt.exe
ftp://ftp.drweb.com/pub/drweb/tools/te94decrypt.exe
2. Save a copy of encrypted file to a USB drive. Test the tool to more than 3 affected files.
3. Copy the file on the root of your USB drive.
4. Press [Windows Key] + [R] on your keyboard or open the Run command from Start Menu.
5. Type this parameter. This assumes that your USB drive is E:
E:\te94decrypt.exe -k 85
Note: If the parameters didn't work, try alternatives such as -k 87, -k 88, -k 90, -k 106, or -k186. You may also request Dr. Web for decryption service by submitting affected files to the following link:
Protect your PC from Locky or Similar Attack
Turn On Security Features of your Internet Browser
Internet Explorer - Activate SmartScreen Filter
Internet Explorer versions 8 and 9 has this feature called SmartScreen Filter. It helps detect phishing web sites and protect you from downloading malicious files online. You may have avoided Locky virus if this has been active on your PC. To turn on SmartScreen Filter, follow these steps:
1. Please open Internet Explorer.
2. On top menu, select Tools (IE 9). For IE 8, please look for Safety menu.
3. Select SmartScreen Filter from the drop-down list and click on Turn on SmartScreen Filter.
2. On top menu, select Tools (IE 9). For IE 8, please look for Safety menu.
3. Select SmartScreen Filter from the drop-down list and click on Turn on SmartScreen Filter.
4. Please restart Internet Explorer.
Google Chrome's Enable Phishing and Malware Protection
With Google Chrome's Phishing and Malware Detection feature, you will have lesser risks browsing the web. It will display a warning when the site you are trying to visit is suspicious. To enable Phishing and Malware Protection, please do these steps:
1. Open Google Chrome.
2. Click on the Customize and control Google Chrome (3-Bars Icon) located on top right corner of the browser.
3. Select Settings from the drop-down list.
4. Once on the settings page, click on Show advanced settings... at the bottom of the page to see the rest of the Chrome setup.
5. Locate Privacy section and mark 'Enable phishing and malware protection'.
2. Click on the Customize and control Google Chrome (3-Bars Icon) located on top right corner of the browser.
3. Select Settings from the drop-down list.
4. Once on the settings page, click on Show advanced settings... at the bottom of the page to see the rest of the Chrome setup.
5. Locate Privacy section and mark 'Enable phishing and malware protection'.
6. Please restart Google Chrome. New settings keep your browser safe while surfing the web.
Mozilla Firefox - Block Attack Sites and Web Forgeries
Phishing and Malware Protection is a built-in feature on Firefox version 3 or later. It warns you when a page you are trying to visit contains phishing content or an attack site designed to drop threats on the computer. To help you keep safe while browsing the Internet using Firefox, please follow this guide:
1. Open Mozilla Firefox browser.
2. On top menu, click on Open Menu. Then select Options from the list.
3. Select Security and put a check mark on the following items:
2. On top menu, click on Open Menu. Then select Options from the list.
3. Select Security and put a check mark on the following items:
- Warn me when sites try to install add-ons
- Block reported attack sites
- Block reported web forgeries
Remove Locky & Protect Your Computer Now!
I managed to remove it with MalwareFox too by rebooting to safe mode and performing the removal process from there, so that works too.
ReplyDelete