Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Locky Ransomware 2.0 and Restore Encrypted Files

A new variant of an already devastating ransomware, Locky is back with different tactics of infection and advanced features. The ransomware is reported to affect users on a massive scale. The newer variant of the ransomware attacks users on a massive scale and infects their computers via a Nuclear Exploit Kit. Not only this, but the ransomware also can perform several other activities on the user PC such as defend itself and evade anti-malware software. All users who have been affected are strongly advised to remove this ransomware using instructions, such as the ones after this article.

Name Locky
Type Ransomware
Short Description Encrypts the user files with a combination of AES and RSA encryption algorhithms and demands ransom payment for the return of the files.
Symptoms The user may witness changed wallpaper and a “HELP_instructions.txt” file to automatically open on startup.
Distribution Method Via PUPs, installed by bundling (Browser Hijackers) or by visiting a suspicious third-party site that is advertising it.
Detection Tool Download Malware Removal Tool, to See If Your System Has Been Affected by Locky
User Experience Join our forum to discuss Locky.

Locky 2.0 Ransomware Distribution

To be spread, this ransomware has been reported by CheckPoint malware researchers to use the Nuclear exploit kit. This is particularly effective method primarily because this kit uses several different targets to spread:

  • Adobe Flash Player.
  • Microsoft Silverlight.
  • Adobe PDF.
  • Internet Explorer Exploits.

The Nuclear exploit kit exists since the year 2009, and it is widely used and effective in dropping a payload of this and other malware on unsuspecting users’ computers.

Related Article:
Exploit Kit Attacks Grow in 2015 Q3; Patch Management is Crucial

Locky Ransomware 2.0 In Detail

Similar to the first variant of Locky Ransomware, the malware is dropped, looks for the same file extensions and uses the two very same primary encryption algorithms to lock the user files:

The combination of the algorithms makes the data impossible to be decrypted. The ransomware scans for the same file extensions such as the first variant, and after encryption changes the wallpaper with the following ransom message:

locky-ransom-message-sensorstechforumSource:Infected YouTube users.

The differences and improvements that the newer variant of Locky possesses are the following:

  • Using Nuclear Exploit Kit to infect more users successfully.
  • Obfuscated its configuration file to make tracing the C&C centers of the cyber-crooks impossible.
  • Shadow execution of its Payload in the shadow volume copies of Windows.
  • New HTTP additions and patches that strengthen its communications and make it significantly more difficult to trace.
  • A new included DGA algorithm to additionally strengthen the communication process with the cyber-criminals.

Conclusion and Removal

The bottom line for the newer variant of Locky ransomware is that it is reported to be even more effective by malware researchers. Given that Locky has had an immense impact on user PCs so far, the second variant of the ransomware may be equal or even better.

Regarding the removal of malicious files used by this Ransomware, it is good to know that the removal instructions remain the same. To remove it permanently without affecting your OS, it is strongly advised to use the steps illustrated below and then to make sure you employ a decent anti-malware software to protect you in the future.

If you want to decrypt your files, unfortunately, you should know that there is no relevant method for the direct decryption of the files. Researchers have not yet discovered any holes and exploits in the code of the malware because the configuration file has its data concealed. But you are welcome to try those mentioned above standard alternative methods for restoring your files.

1. Boot Your PC In Safe Mode to isolate and remove Locky
2. Remove Locky with SpyHunter Anti-Malware Tool
3. Back up your data to secure it against infections and file encryption by Locky in the future
4. Restore files encrypted by Locky
NOTE! Substantial notification about the Locky threat: Manual removal of Locky requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.