Remove Locky Ransomware 2.0 and Restore Encrypted Files - How to, Technology and PC Security Forum |

Remove Locky Ransomware 2.0 and Restore Encrypted Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

A new variant of an already devastating ransomware, Locky is back with different tactics of infection and advanced features. The ransomware is reported to affect users on a massive scale. The newer variant of the ransomware attacks users on a massive scale and infects their computers via a Nuclear Exploit Kit. Not only this, but the ransomware also can perform several other activities on the user PC such as defend itself and evade anti-malware software. All users who have been affected are strongly advised to remove this ransomware using instructions, such as the ones after this article.

Short DescriptionEncrypts the user files with a combination of AES and RSA encryption algorhithms and demands ransom payment for the return of the files.
SymptomsThe user may witness changed wallpaper and a “HELP_instructions.txt” file to automatically open on startup.
Distribution MethodVia PUPs, installed by bundling (Browser Hijackers) or by visiting a suspicious third-party site that is advertising it.
Detection ToolDownload Malware Removal Tool, to See If Your System Has Been Affected by Locky
User Experience Join our forum to discuss Locky.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Locky 2.0 Ransomware Distribution

To be spread, this ransomware has been reported by CheckPoint malware researchers to use the Nuclear exploit kit. This is particularly effective method primarily because this kit uses several different targets to spread:

  • Adobe Flash Player.
  • Microsoft Silverlight.
  • Adobe PDF.
  • Internet Explorer Exploits.

The Nuclear exploit kit exists since the year 2009, and it is widely used and effective in dropping a payload of this and other malware on unsuspecting users’ computers.

Related Article:
Exploit Kit Attacks Grow in 2015 Q3; Patch Management is Crucial

Locky Ransomware 2.0 In Detail

Similar to the first variant of Locky Ransomware, the malware is dropped, looks for the same file extensions and uses the two very same primary encryption algorithms to lock the user files:

The combination of the algorithms makes the data impossible to be decrypted. The ransomware scans for the same file extensions such as the first variant, and after encryption changes the wallpaper with the following ransom message:

locky-ransom-message-sensorstechforumSource:Infected YouTube users.

The differences and improvements that the newer variant of Locky possesses are the following:

  • Using Nuclear Exploit Kit to infect more users successfully.
  • Obfuscated its configuration file to make tracing the C&C centers of the cyber-crooks impossible.
  • Shadow execution of its Payload in the shadow volume copies of Windows.
  • New HTTP additions and patches that strengthen its communications and make it significantly more difficult to trace.
  • A new included DGA algorithm to additionally strengthen the communication process with the cyber-criminals.

Conclusion and Removal

The bottom line for the newer variant of Locky ransomware is that it is reported to be even more effective by malware researchers. Given that Locky has had an immense impact on user PCs so far, the second variant of the ransomware may be equal or even better.

Regarding the removal of malicious files used by this Ransomware, it is good to know that the removal instructions remain the same. To remove it permanently without affecting your OS, it is strongly advised to use the steps illustrated below and then to make sure you employ a decent anti-malware software to protect you in the future.

If you want to decrypt your files, unfortunately, you should know that there is no relevant method for the direct decryption of the files. Researchers have not yet discovered any holes and exploits in the code of the malware because the configuration file has its data concealed. But you are welcome to try those mentioned above standard alternative methods for restoring your files.

1. Boot Your PC In Safe Mode to isolate and remove Locky
2. Remove Locky with SpyHunter Anti-Malware Tool
3. Back up your data to secure it against infections and file encryption by Locky in the future
4. Restore files encrypted by Locky
NOTE! Substantial notification about the Locky threat: Manual removal of Locky requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share