RozaLocker .enc File Virus – Restore Files - How to, Technology and PC Security Forum |

RozaLocker .enc File Virus – Restore Files


with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by .enc File Virus and other threats.
Threats such as .enc File Virus may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

Article created to help remove RozaLocker ransomware and give tips on how to restore encrypted files with the .enc file extension, instead of paying the 10000 rubles ransom.

A virus from the file encryption type has been reported by malware researchers to attack Russian-speaking users. The ransomware infection performs multiple different activities on the compromised computers. The malware is dubbed RozaLocker and drops a ReadMe.txt file after it infects a computer. The .txt file has a ransom note with demands to pay the sum of 10000 rubles which is approximately 170 US dollars. The cyber-criminals promise that after they receive a payment, they will decrypt the files, but it is strongly advisable not to make any payoff and instead read the following article carefully.

Threat Summary


.enc File Virus

Short DescriptionThis ransomware infection encrypts files on the compromised computer and asks the user to pay approximaely 170$ for the file recovery.
SymptomsThe user may witness ransom note, named ReadMe.txt and the important files on the computer may be encrypted.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by .enc File Virus


Malware Removal Tool

User ExperienceJoin our forum to Discuss .enc File Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

RozaLocker Ransomware – How Does It Infect

For the infection procedure, the virus may undertake a massive e-mail spam campaign, oriented towards Russian-speaking users. What is particularly interesting in this situation is that the RozaLocker threat may sent the spam messages with deceitful messages within them. Amongst the deceptive templates may be included claims the user has purchased something online and even claims that there is suspicious activity on his or hers paypal or bank account. The end goal of those e-mails is to open the e-mail attachments that cause the actual infection with RozaLocker. The e-mails sent may appear like the example image below:

But this is not the only infection method that may exist when it comes to this particular ransomware. It may also be uploaded in a hacked account of uploaders on torrent websites. Since accounts on these sites have usually a high rate of infection, reports often indicate that these accounts are hacked and malicious infectors may be uploaded through them. The infection files may pretend to be game patches, cracks and other fake installers, users believe are legitimate.

RozaLocker .enc Variant – Infection Activity

When a malicious file carrying the download script or RozaLocker has been activated, the virus may connect to a remote host. This is done with the one and only purpose of downloading the payload of RozaLocker and dropping the malicious files which later render most of the usable data no longer openable. The malicious payload dropped, may consist of the following files:

  • A setup.exe file with malicious scripts in it which may be the encryption module.
  • A ReadMe.txt ransom note of RozaLocker which has the payoff demands.
  • A qt_temp.Hp module.
  • A trainer.exe file which displays a pop-up.

Both the qt_temp and trainer file are located in the Windows directory. Other files may be scattered in numerous other folders:

  • %AppData%
  • %System Drive%
  • %System32%
  • %Temp%
  • %Local%
  • %Roaming%
  • %LocalRow%

Once the virus is ran on the computer, it asks the user from Windows Smart Screen to run the setup.exe file. In the event that the user is inexperienced enough and activates the setup.exe file, the virus displays a pop-up translating to “Game program from Sashi The Renderer”.

RozaLocker – The Encryption Procedure

The encryption process of RozaLocker involves altering the data of original files with symbols from the encryption algorithm used by the ransomware. The usually targeted files by RozaLocker may be Microsoft Office documents, image files, Adobe Reader files, music, videos and other files that may be of importance to the victim. If we have to sum it up, the virus may encrypt files that are often used, like the following file types:


After the encryption procedure has been completed, the encrypted files are rendered no longer able to be opened. They are also appended the .enc file extension after their original one and may look like the following image:

After the encryption process has completed, this ransomware virus also drops it’s ransom note which roughly translates to:

1) Find 10 000 (10 thousand) rubles, not less. Suitable for the following –
(Qiwi, Sberbank, Yandex.Money, Tinkoff Bank, VTB, but better Qiwi (faster)
2) In the browser, open the site – through this site you will transfer money
3) In the column I DELETE where you will translate (according to item 1) and above enter the amount – 10,000 rubles.
4) In the RIGHT I select Bitcoin and on top the amount should automatically be transferred to btc
5) In the column DATA ENTRY, fill in your requisites from where you will pay and where to transfer (Bitcoin wallet)
ATTENTION-ATTENTION, CORRECTly copy this number to a purse (yes, it’s so strange)
After inserting, carefully, again check whether it is copied correctly.
6) Click on GO TO PAY and follow the instructions on the site.
In a couple of hours we’ll write you on the desktop and return everything to you.
If there are difficulties, then write on the mailbox – [email protected]

Remove RozaLocker Ransomware and Try Getting Back .enc Files

Before attempting any removal of RozaLocker ransomware, recommendations are to back up the encrypted files before the actual removal takes place, just In case.

Then, for the removal process, we advise you to follow the removal instructions below. But in case you lack the experience and feel uncertain that you will fix all infected objects and remove the malicious ones manually, recommendations are to remove this ransomware infection automatically. One way to do this is via an advanced anti-malware software which will automatically remove RozaLocker ransomware and protect you from such threats in the future too,

For the file recovery of .enc files, encrypted by this virus, at the moment there is no direct free solution. However, paying the ransom is also highly inadvisable because it may not result in you getting your files back. This is why we recommend checking out some alternative methods that can recover a portion of your files. They are published in step “2. Restore files encrypted by .enc File Virus” and are no guarantee you will get all your data back, but you may get back at least a part of it.

Note! Your computer system may be affected by .enc File Virus and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as .enc File Virus.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove .enc File Virus follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove .enc File Virus files and objects
2. Find files created by .enc File Virus on your PC

Before starting the Automatic Removal below, please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by .enc File Virus

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share