Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove ShellLocker Ransomware and Restore .L0cked Files

shelllocker-main-pic-sensorstechforum“Your PC is locked by the ShellLocker” – this is what victims see when their wallpaper is changed with the skull wallpaper of the latest .net based ransomware, called ShellLocker. After this particular virus encrypts the files on the compromised computer, it begins to change their names to random letters, numbers as well as symbols and it also begins to add it’s distinctive .l0cked file extension. After having done this, ShellLocker ransomware aims to get victims to pay a hefty ransom fee by extorting them for the access to their files it has encrypted. Anyone who has been infected by ShellLocker Ransomware should read this article to learn more about this threat, how to properly remove it and try to restore the files.

Threat Summary

Name

ShellLocker

Type Ransomware
Short Description The malware encrypts users files using a strong encryption algorithm using a .cmd file, making direct decryption possible only via a unique decryption key available to the cyber-criminals.
Symptoms The user may witness ransom notes and “instructions” linking to a BitCoin address on which 100$ are extorted from the user. Changed file names and the file-extension .L0cked has been used.
Distribution Method Via a “Documents.cmd” executable.
Detection Tool See If Your System Has Been Affected by ShellLocker

Download

Malware Removal Tool

User Experience Join our forum to Discuss ShellLocker.
Data Recovery Tool Data Recovery Pro by ParetoLogic Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

ShellLocker Ransomware – How Did I Get Infected

According to malware researchers, the malicious payload of ShellLocker ransomware is actually a .cmd file that runs privileged commands to execute, just like an old-school retro virus. This .cmd file may be spread via several different forms of spam, such as e-mail spam messages (as attachments) or malicious URLs posted on various places on the web. The opening of those malicious web links may cause a so-called drive-by download which automatically executes the “Documents.cmd” file, detected by VirusTotal:

shelllocker-cmd-infection-file-sensorstechforum

ShellLocker Ransomware – Post-Infection Analysis

Once ShellLocker has been executed on the computer, it may remotely connect to malicious web servers and from there download the ransom note and a program with a countdown timer:

Source: Jakoub Kroustek - Twitter (@JakubKroustek

Source: Jakoub Kroustek – Twitter (@JakubKroustek

The files downloaded by ShellLocker may be located in several Windows key folders, such as %AppData% and %Startup% folders. The %Startup% folder allows for every file dropped there to automatically start on Windows boot up.

After these files are created the ShellLocker virus may execute a command that deletes the shadow copies of the infected computer. The command may be executed in /quiet mode which hides it from the user. Usually this is done with the vssadmin instruction as an administrator privilege, to which ShellLocker immediately obtains access:

→vssadmin delete shadows /forvolume=C: /all /quiet

After this command is executed, ShellLocker may get down to the file encryption phase. To encrypt files, the ShellLocker ransomware begins looking for widely used file types to encrypt. The ransomware may encode all files associated with:

  • Videos.
  • Music.
  • Pictures.
  • Databases.
  • Microsoft Office.
  • Adobe.
  • Other often used programs.

As soon as all the files are encrypted, the wallpaper of the user is changed to the following:

sensorstechforum-shelllocker-ransomware-encrypted-files-l0cked

The encrypted files by ShellLocker are with completely random file names and the .l0cked file extension changed on them, so they become completely non-recognizable.

l0cked-file-extension-ransomware-shelllocker-sensorstechforum

After the encryption, the user is left with no choice but to follow the ransom instructions:

→“All your photos, videos, music’s are encrypted, you have IV VII hours to pay 100 USD in bitcoins to the address below, after IV VIII hours all your files will be gone!
When you pay the money It will take 30 minutes and your files will be back. Try something funny and your files will be gone. You can delete the virus but your files are gone too! Have a nice day”

How to Cope With ShellLocker and Try to Restore the Files

Since ShellLocker not only threatens to destroy the files after the deadline of 48 hours, the virus also threatens to delete the encrypted files if it, itself is deleted. This is why, the first thing we recommend you to do is to perform an online backup of the encrypted files. This will allow you to remove the virus safely from your computer.

To remove ShellLocker efficiently we have provided instructions below that will help you perform manual removal and automatic one with an advanced anti-malware tool (recommended).

After having removed the ShellLocker ransomware, we urge you to undertake our alternative options to restore your files instead of paying 100$ to support cyber-criminals. The alternative tools may not be fully effective but you may restore some of your files in some particular situations. We will keep following the situation and update this article as soon as a decryptor is released.

Manually delete ShellLocker from your computer

Note! Substantial notification about the ShellLocker threat: Manual removal of ShellLocker requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove ShellLocker files and objects
2.Find malicious files created by ShellLocker on your PC

Automatically remove ShellLocker by downloading an advanced anti-malware program

1. Remove ShellLocker with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by ShellLocker
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.