Remove Lock93 Ransomware and Decrypt .lock93 Files - How to, Technology and PC Security Forum |

Remove Lock93 Ransomware and Decrypt .lock93 Files


Lock93 is a newly-emerged ransomware cryptovirus. The ransom note which is displayed after the file encryption process is complete can be written either in Russian or English. All encrypted files will have the extension .lock93 appended to them. The origin of the virus is unknown and its versatile ransom message proves that its target is not solely Russia. To see how to remove the ransomware and how you can try to restore your data, carefully read the article.

Threat Summary

NameLock93 Ransomware
TypeRansomware, Cryptovirus
Short DescriptionThe ransomware will encrypt your files and then display its ransom message with instructions and demands.
SymptomsThe ransom note that is displayed depends on your preferred language and can be either in Russian or English. Encrypted files will have the .lock93 extension appended to them.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Lock93 Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Lock93 Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Lock93 Ransomware – Infection

Lock93 ransomware can infect your computer device using a few methods. Spam email campaigns could be spreading its payload file. An electronic letter of a spam campaign is written in a way to make you think that it’s important along with its attachment. In actuality, the attached file will look exactly like it is presented, but in fact, contain malicious code. Opening the attachment will release that code from the file and infect your computer machine.

More infection method for the Lock93 ransomware might be at play. For example, the malware creators could be distributing the files via social media and file-sharing networks. The malicious payload file could be put on such platforms to attempt infecting more potential victims. When browsing the Internet, try to be more careful. Refrain from opening files from suspicious links and emails. Scan such files with a security application and check their signatures and size before opening. You should read the tips about preventing ransomware in our forum.

Lock93 Ransomware – Information

Malware researchers from the MalwareHunterTeam have recently found a new ransomware virus. They have named it Lock93 after the extension it puts to all encrypted files. The ransom message is also a lock screen and contains instructions for paying.

After the Lock93 ransomware executes its payload, it could make entries in the Windows Registry to be more resilient. Such registry entries are made in a way to make the virus launch automatically every time the Windows operating system starts. What follows is that your files get encrypted, and then the lock screen with the ransom message shows up on your desktop. The ransom message is written either in Russian or English. That may depend on what language you have set as default on your system or where you got the ransomware from.

You can preview the ransom message written in Russian from the image below:


The text reads the following:

Для расшифровки данных отправьте код на E-mail
После этого вы получите инструкции по оплате
После оплаты вы получите код разблокировки и все данные будут расшифрованы

Не удаляйте и не редактируйте файлы с расширением lock93 и фалы самого вируса,
т. к. это может привести к потере данных

Стоимость расшифровки: 1000 рублей

You can preview the ransom message written in English right here:


It reads the following:

Send the code to the e-mail
You will get payment instructions
After payment you will get the unlock code and your data will be decrypted

Do not delete or modify files with extension lock93 and virus files because it can
destroy your data

Price: 1000 RUR

The Lock93 virus uses the email address as a contact detail in both ransom notes. That doesn’t necessarily mean that the ransomware originates from Russia, although it seems logical to be the case.

The Lock93 ransomware does not give you any deadline to decrypt your data and demands 1000 Russian rubles. That amount equals to 16 US dollars. You shouldn’t be thinking of paying the crooks, regardless of how small the ransom price is. No one can guarantee that you will restore your data after payment. Criminals such as these use the money for making new ransomware or to fund other criminal actions.

A full list with file types that become encrypted is currently unavailable, but the following ones have been recorded to be encrypted:

→.png, .doc, docx, .jpeg, .jpg, .ppt, .pptx, .odt, .pdf, .psd, .rtf, .html, .xll, .xlm, .xls, .xlsx, .xml

All encrypted files will have the .lock93 extension appended to them, after the original file extension. It is unknown what encryption algorithm is being used by this virus, but researchers believe that it can be decrypted.

The Lock93 ransomware is likely to erase the Shadow Volume Copies of the Windows operating system with the following command:

→vssadmin.exe delete shadows /all /Quiet

Read further to check out what methods you can try to decrypt your locked files and data.

Remove Lock93 Ransomware and Decrypt .lock93 Files

If your computer got infected with the Lock93 ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Lock93 Ransomware.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share