The LOCKER-PAY ransomware virus is a threat which aims to lock your computer screen and then demand that you make a payment to unlock it. The virus may use different types of scripts to prevent users to bypass the lockscreen even after you press every key on your keyboard. In case your computer has been infected by the LOCKER-PAY ransomware virus, we strongly recommend that you read this article instead of paying a hefty ransom fee.
|Short Description||Locks your screen and keeps it that way until you pay a ransom in BTC.|
|Symptoms||The screen Is locked with an annoying message and you cannot work on your computer.|
|Distribution Method||Spam Emails, Email Attachments, Executable files|
|Detection Tool|| See If Your System Has Been Affected by LOCKER-PAY |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss LOCKER-PAY.|
LOCKER-PAY Ransomware Virus – Distribution
The LOCKER-PAY ransomware may be spread via multiple different methods, the primary of which may be via e-mail malspam, like the example below displays:
Usually such e-mails tend to carry the infection file of ransomware viruses, like LOCKER-PAY. The files are either concealed documents with malicous macros which cause an infection by clicking on the “Enable Content” button or be direct executable type of files, for example:
→ .exe, .vbs, .wsf, .js, .htm, .hta, .bat
Once the victim clicks on those files, the infection process is triggered and conducted in an obfuscated manner so that the victim is unable to detect that his or hers computer is being attacked.
Other methods by which you can end up a victim of the LOCKER-PAY ransomware threat are if you open a malicous file that pretends to be a legitimate setup of a program you were looking to download online. The same goes for any type of downloaded file – game cracks, key generators and many others.
LOCKER-PAY Virus – Analysis
The LOCKER-PAY ransomware threat is a locksreen type of malware, which aims to modify the settings on your computer so that it completely denies you from using it. This is done by firstly dropping the malicious files of LOCKER-PAY immediately after infection. They may be more than one and may be located under different names in the following Windows folders:
After dropping the malicious files, the LOCKER-PAY virus may attack numerous Windows registry entries in the Windows registry editor. As soon as it does this, the ransomware may display an error message, restart the infected computer, after which locks out the screen, displaying the following image:
Text from image:
“YOUR SYSTEM HAS BEEN LOCKED BY LOCKER-PAY RAMSOMWARE!
Your system is now locked! You can’t use antivirus, listen music, edit documents, etc.
But don’t worry! I haven’t encrypt them yet.
You have 48 hours to buy special unlocking key.
After this time, your hard drive will be FORMATTER!
If you reboot your computer or try to close me, your hard drive will be FORMATTER too!
See “How can I pay?” to do a payment. It’s very easy =)
After, if you done payment, if you enter unlocking key to the box below, your computer will be unlocked and you’ll see desktop with your files.”
After the lock procedure, the user cannot use any aspect of his computer, except to type the Unlock key and to click on the “How can I pay?” button to see further unlock instructons.
Despite the situation being as it is, security experts strongly urge all victims of LOCKER-PAY not to do any type of Bitcoin payment to cyber-criminals, because they should not be trusted and remove the virus instead.
Remove LOCKER-PAY Ransomware and Unlock Your Screen
There are multiple methods to remove this virus from your computer. We strongly suggest you to try and bypass the lockscreen in Safe Mode, using the instructions below after which you should be able to remove it by following either the manual or the automatic removal instructions to get rid of LOCKER-PAY. For maximum effectiveness during the removal process, we advise you to boot into Safe Mode with networking and install and advanced anti-malware software which has the one and only goal to fully and safely remove the LOCKER-PAY threat and ensure future protection against malware.