“Your PC is locked by the ShellLocker” – this is what victims see when their wallpaper is changed with the skull wallpaper of the latest .net based ransomware, called ShellLocker. After this particular virus encrypts the files on the compromised computer, it begins to change their names to random letters, numbers as well as symbols and it also begins to add it’s distinctive .l0cked file extension. After having done this, ShellLocker ransomware aims to get victims to pay a hefty ransom fee by extorting them for the access to their files it has encrypted. Anyone who has been infected by ShellLocker Ransomware should read this article to learn more about this threat, how to properly remove it and try to restore the files.
|Short Description||The malware encrypts users files using a strong encryption algorithm using a .cmd file, making direct decryption possible only via a unique decryption key available to the cyber-criminals.|
|Symptoms||The user may witness ransom notes and “instructions” linking to a BitCoin address on which 100$ are extorted from the user. Changed file names and the file-extension .L0cked has been used.|
|Distribution Method||Via a “Documents.cmd” executable.|
|Detection Tool|| See If Your System Has Been Affected by ShellLocker |
Malware Removal Tool
|User Experience||Join our forum to Discuss ShellLocker.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
ShellLocker Ransomware – How Did I Get Infected
According to malware researchers, the malicious payload of ShellLocker ransomware is actually a .cmd file that runs privileged commands to execute, just like an old-school retro virus. This .cmd file may be spread via several different forms of spam, such as e-mail spam messages (as attachments) or malicious URLs posted on various places on the web. The opening of those malicious web links may cause a so-called drive-by download which automatically executes the “Documents.cmd” file, detected by VirusTotal:
ShellLocker Ransomware – Post-Infection Analysis
Once ShellLocker has been executed on the computer, it may remotely connect to malicious web servers and from there download the ransom note and a program with a countdown timer:
The files downloaded by ShellLocker may be located in several Windows key folders, such as %AppData% and %Startup% folders. The %Startup% folder allows for every file dropped there to automatically start on Windows boot up.
After these files are created the ShellLocker virus may execute a command that deletes the shadow copies of the infected computer. The command may be executed in /quiet mode which hides it from the user. Usually this is done with the vssadmin instruction as an administrator privilege, to which ShellLocker immediately obtains access:
→vssadmin delete shadows /forvolume=C: /all /quiet
After this command is executed, ShellLocker may get down to the file encryption phase. To encrypt files, the ShellLocker ransomware begins looking for widely used file types to encrypt. The ransomware may encode all files associated with:
- Microsoft Office.
- Other often used programs.
As soon as all the files are encrypted, the wallpaper of the user is changed to the following:
The encrypted files by ShellLocker are with completely random file names and the .l0cked file extension changed on them, so they become completely non-recognizable.
After the encryption, the user is left with no choice but to follow the ransom instructions:
→“All your photos, videos, music’s are encrypted, you have IV VII hours to pay 100 USD in bitcoins to the address below, after IV VIII hours all your files will be gone!
When you pay the money It will take 30 minutes and your files will be back. Try something funny and your files will be gone. You can delete the virus but your files are gone too! Have a nice day”
How to Cope With ShellLocker and Try to Restore the Files
Since ShellLocker not only threatens to destroy the files after the deadline of 48 hours, the virus also threatens to delete the encrypted files if it, itself is deleted. This is why, the first thing we recommend you to do is to perform an online backup of the encrypted files. This will allow you to remove the virus safely from your computer.
To remove ShellLocker efficiently we have provided instructions below that will help you perform manual removal and automatic one with an advanced anti-malware tool (recommended).
After having removed the ShellLocker ransomware, we urge you to undertake our alternative options to restore your files instead of paying 100$ to support cyber-criminals. The alternative tools may not be fully effective but you may restore some of your files in some particular situations. We will keep following the situation and update this article as soon as a decryptor is released.