Lock93 is a newly-emerged ransomware cryptovirus. The ransom note which is displayed after the file encryption process is complete can be written either in Russian or English. All encrypted files will have the extension .lock93 appended to them. The origin of the virus is unknown and its versatile ransom message proves that its target is not solely Russia. To see how to remove the ransomware and how you can try to restore your data, carefully read the article.
|Short Description||The ransomware will encrypt your files and then display its ransom message with instructions and demands.|
|Symptoms||The ransom note that is displayed depends on your preferred language and can be either in Russian or English. Encrypted files will have the .lock93 extension appended to them.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by Lock93 Ransomware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Lock93 Ransomware.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Lock93 Ransomware – Infection
Lock93 ransomware can infect your computer device using a few methods. Spam email campaigns could be spreading its payload file. An electronic letter of a spam campaign is written in a way to make you think that it’s important along with its attachment. In actuality, the attached file will look exactly like it is presented, but in fact, contain malicious code. Opening the attachment will release that code from the file and infect your computer machine.
More infection method for the Lock93 ransomware might be at play. For example, the malware creators could be distributing the files via social media and file-sharing networks. The malicious payload file could be put on such platforms to attempt infecting more potential victims. When browsing the Internet, try to be more careful. Refrain from opening files from suspicious links and emails. Scan such files with a security application and check their signatures and size before opening. You should read the tips about preventing ransomware in our forum.
Lock93 Ransomware – Information
Malware researchers from the MalwareHunterTeam have recently found a new ransomware virus. They have named it Lock93 after the extension it puts to all encrypted files. The ransom message is also a lock screen and contains instructions for paying.
After the Lock93 ransomware executes its payload, it could make entries in the Windows Registry to be more resilient. Such registry entries are made in a way to make the virus launch automatically every time the Windows operating system starts. What follows is that your files get encrypted, and then the lock screen with the ransom message shows up on your desktop. The ransom message is written either in Russian or English. That may depend on what language you have set as default on your system or where you got the ransomware from.
You can preview the ransom message written in Russian from the image below:
The text reads the following:
Для расшифровки данных отправьте код на E-mail
После этого вы получите инструкции по оплате
После оплаты вы получите код разблокировки и все данные будут расшифрованы
Не удаляйте и не редактируйте файлы с расширением lock93 и фалы самого вируса,
т. к. это может привести к потере данных
Стоимость расшифровки: 1000 рублей
You can preview the ransom message written in English right here:
It reads the following:
Send the code to the e-mail
You will get payment instructions
After payment you will get the unlock code and your data will be decrypted
Do not delete or modify files with extension lock93 and virus files because it can
destroy your data
Price: 1000 RUR
The Lock93 virus uses the email address firstname.lastname@example.org as a contact detail in both ransom notes. That doesn’t necessarily mean that the ransomware originates from Russia, although it seems logical to be the case.
The Lock93 ransomware does not give you any deadline to decrypt your data and demands 1000 Russian rubles. That amount equals to 16 US dollars. You shouldn’t be thinking of paying the crooks, regardless of how small the ransom price is. No one can guarantee that you will restore your data after payment. Criminals such as these use the money for making new ransomware or to fund other criminal actions.
A full list with file types that become encrypted is currently unavailable, but the following ones have been recorded to be encrypted:
→.png, .doc, docx, .jpeg, .jpg, .ppt, .pptx, .odt, .pdf, .psd, .rtf, .html, .xll, .xlm, .xls, .xlsx, .xml
All encrypted files will have the .lock93 extension appended to them, after the original file extension. It is unknown what encryption algorithm is being used by this virus, but researchers believe that it can be decrypted.
The Lock93 ransomware is likely to erase the Shadow Volume Copies of the Windows operating system with the following command:
→vssadmin.exe delete shadows /all /Quiet
Read further to check out what methods you can try to decrypt your locked files and data.
Remove Lock93 Ransomware and Decrypt .lock93 Files
If your computer got infected with the Lock93 ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Lock93 Ransomware.