Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Lock93 Ransomware and Decrypt .lock93 Files

stf-lock93-ransomware-lock-93-virus-russian-ransomware-note

Lock93 is a newly-emerged ransomware cryptovirus. The ransom note which is displayed after the file encryption process is complete can be written either in Russian or English. All encrypted files will have the extension .lock93 appended to them. The origin of the virus is unknown and its versatile ransom message proves that its target is not solely Russia. To see how to remove the ransomware and how you can try to restore your data, carefully read the article.

Threat Summary

Name Lock93 Ransomware
Type Ransomware, Cryptovirus
Short Description The ransomware will encrypt your files and then display its ransom message with instructions and demands.
Symptoms The ransom note that is displayed depends on your preferred language and can be either in Russian or English. Encrypted files will have the .lock93 extension appended to them.
Distribution Method Spam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Lock93 Ransomware

Download

Malware Removal Tool

User Experience Join Our Forum to Discuss Lock93 Ransomware.
Data Recovery Tool Data Recovery Pro by ParetoLogic Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Lock93 Ransomware – Infection

Lock93 ransomware can infect your computer device using a few methods. Spam email campaigns could be spreading its payload file. An electronic letter of a spam campaign is written in a way to make you think that it’s important along with its attachment. In actuality, the attached file will look exactly like it is presented, but in fact, contain malicious code. Opening the attachment will release that code from the file and infect your computer machine.

More infection method for the Lock93 ransomware might be at play. For example, the malware creators could be distributing the files via social media and file-sharing networks. The malicious payload file could be put on such platforms to attempt infecting more potential victims. When browsing the Internet, try to be more careful. Refrain from opening files from suspicious links and emails. Scan such files with a security application and check their signatures and size before opening. You should read the tips about preventing ransomware in our forum.

Lock93 Ransomware – Information

Malware researchers from the MalwareHunterTeam have recently found a new ransomware virus. They have named it Lock93 after the extension it puts to all encrypted files. The ransom message is also a lock screen and contains instructions for paying.

After the Lock93 ransomware executes its payload, it could make entries in the Windows Registry to be more resilient. Such registry entries are made in a way to make the virus launch automatically every time the Windows operating system starts. What follows is that your files get encrypted, and then the lock screen with the ransom message shows up on your desktop. The ransom message is written either in Russian or English. That may depend on what language you have set as default on your system or where you got the ransomware from.

You can preview the ransom message written in Russian from the image below:

stf-lock93-ransomware-lock-93-virus-russian-ransomware-note

The text reads the following:

Для расшифровки данных отправьте код на E-mail
После этого вы получите инструкции по оплате
После оплаты вы получите код разблокировки и все данные будут расшифрованы

Не удаляйте и не редактируйте файлы с расширением lock93 и фалы самого вируса,
т. к. это может привести к потере данных

Стоимость расшифровки: 1000 рублей
E-mail: oplaticydadeng@mail.ru

You can preview the ransom message written in English right here:

stf-lock93-ransomware-lock-93-russian-virus-ransomware-note-english-version

It reads the following:

Send the code to the e-mail
You will get payment instructions
After payment you will get the unlock code and your data will be decrypted

Do not delete or modify files with extension lock93 and virus files because it can
destroy your data

Price: 1000 RUR
E-mail: oplaticydadeng@mail.ru

The Lock93 virus uses the email address oplaticydadeng@mail.ru as a contact detail in both ransom notes. That doesn’t necessarily mean that the ransomware originates from Russia, although it seems logical to be the case.

The Lock93 ransomware does not give you any deadline to decrypt your data and demands 1000 Russian rubles. That amount equals to 16 US dollars. You shouldn’t be thinking of paying the crooks, regardless of how small the ransom price is. No one can guarantee that you will restore your data after payment. Criminals such as these use the money for making new ransomware or to fund other criminal actions.

A full list with file types that become encrypted is currently unavailable, but the following ones have been recorded to be encrypted:

→.png, .doc, docx, .jpeg, .jpg, .ppt, .pptx, .odt, .pdf, .psd, .rtf, .html, .xll, .xlm, .xls, .xlsx, .xml

All encrypted files will have the .lock93 extension appended to them, after the original file extension. It is unknown what encryption algorithm is being used by this virus, but researchers believe that it can be decrypted.

The Lock93 ransomware is likely to erase the Shadow Volume Copies of the Windows operating system with the following command:

→vssadmin.exe delete shadows /all /Quiet

Read further to check out what methods you can try to decrypt your locked files and data.

Remove Lock93 Ransomware and Decrypt .lock93 Files

If your computer got infected with the Lock93 ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Lock93 Ransomware.

Manually delete Lock93 Ransomware from your computer

Note! Substantial notification about the Lock93 Ransomware threat: Manual removal of Lock93 Ransomware requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Lock93 Ransomware files and objects
2.Find malicious files created by Lock93 Ransomware on your PC

Automatically remove Lock93 Ransomware by downloading an advanced anti-malware program

1. Remove Lock93 Ransomware with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Lock93 Ransomware
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.