Remove Lock93 Ransomware and Decrypt .lock93 Files - How to, Technology and PC Security Forum | SensorsTechForum.com
THREAT REMOVAL

Remove Lock93 Ransomware and Decrypt .lock93 Files

OFFER

SCAN YOUR PC
with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by Lock93 Ransomware and other threats.
Threats such as Lock93 Ransomware may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

stf-lock93-ransomware-lock-93-virus-russian-ransomware-note

Lock93 is a newly-emerged ransomware cryptovirus. The ransom note which is displayed after the file encryption process is complete can be written either in Russian or English. All encrypted files will have the extension .lock93 appended to them. The origin of the virus is unknown and its versatile ransom message proves that its target is not solely Russia. To see how to remove the ransomware and how you can try to restore your data, carefully read the article.

Threat Summary

NameLock93 Ransomware
TypeRansomware, Cryptovirus
Short DescriptionThe ransomware will encrypt your files and then display its ransom message with instructions and demands.
SymptomsThe ransom note that is displayed depends on your preferred language and can be either in Russian or English. Encrypted files will have the .lock93 extension appended to them.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Lock93 Ransomware

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Lock93 Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Lock93 Ransomware – Infection

Lock93 ransomware can infect your computer device using a few methods. Spam email campaigns could be spreading its payload file. An electronic letter of a spam campaign is written in a way to make you think that it’s important along with its attachment. In actuality, the attached file will look exactly like it is presented, but in fact, contain malicious code. Opening the attachment will release that code from the file and infect your computer machine.

More infection method for the Lock93 ransomware might be at play. For example, the malware creators could be distributing the files via social media and file-sharing networks. The malicious payload file could be put on such platforms to attempt infecting more potential victims. When browsing the Internet, try to be more careful. Refrain from opening files from suspicious links and emails. Scan such files with a security application and check their signatures and size before opening. You should read the tips about preventing ransomware in our forum.

Lock93 Ransomware – Information

Malware researchers from the MalwareHunterTeam have recently found a new ransomware virus. They have named it Lock93 after the extension it puts to all encrypted files. The ransom message is also a lock screen and contains instructions for paying.

After the Lock93 ransomware executes its payload, it could make entries in the Windows Registry to be more resilient. Such registry entries are made in a way to make the virus launch automatically every time the Windows operating system starts. What follows is that your files get encrypted, and then the lock screen with the ransom message shows up on your desktop. The ransom message is written either in Russian or English. That may depend on what language you have set as default on your system or where you got the ransomware from.

You can preview the ransom message written in Russian from the image below:

stf-lock93-ransomware-lock-93-virus-russian-ransomware-note

The text reads the following:

Для расшифровки данных отправьте код на E-mail
После этого вы получите инструкции по оплате
После оплаты вы получите код разблокировки и все данные будут расшифрованы

Не удаляйте и не редактируйте файлы с расширением lock93 и фалы самого вируса,
т. к. это может привести к потере данных

Стоимость расшифровки: 1000 рублей
E-mail: [email protected]

You can preview the ransom message written in English right here:

stf-lock93-ransomware-lock-93-russian-virus-ransomware-note-english-version

It reads the following:

Send the code to the e-mail
You will get payment instructions
After payment you will get the unlock code and your data will be decrypted

Do not delete or modify files with extension lock93 and virus files because it can
destroy your data

Price: 1000 RUR
E-mail: [email protected]

The Lock93 virus uses the email address [email protected] as a contact detail in both ransom notes. That doesn’t necessarily mean that the ransomware originates from Russia, although it seems logical to be the case.

The Lock93 ransomware does not give you any deadline to decrypt your data and demands 1000 Russian rubles. That amount equals to 16 US dollars. You shouldn’t be thinking of paying the crooks, regardless of how small the ransom price is. No one can guarantee that you will restore your data after payment. Criminals such as these use the money for making new ransomware or to fund other criminal actions.

A full list with file types that become encrypted is currently unavailable, but the following ones have been recorded to be encrypted:

→.png, .doc, docx, .jpeg, .jpg, .ppt, .pptx, .odt, .pdf, .psd, .rtf, .html, .xll, .xlm, .xls, .xlsx, .xml

All encrypted files will have the .lock93 extension appended to them, after the original file extension. It is unknown what encryption algorithm is being used by this virus, but researchers believe that it can be decrypted.

The Lock93 ransomware is likely to erase the Shadow Volume Copies of the Windows operating system with the following command:

→vssadmin.exe delete shadows /all /Quiet

Read further to check out what methods you can try to decrypt your locked files and data.

Remove Lock93 Ransomware and Decrypt .lock93 Files

If your computer got infected with the Lock93 ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Lock93 Ransomware.

Note! Your computer system may be affected by Lock93 Ransomware and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as Lock93 Ransomware.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove Lock93 Ransomware follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove Lock93 Ransomware files and objects
2. Find files created by Lock93 Ransomware on your PC

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by Lock93 Ransomware

Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...