RozaLocker .enc File Virus – Restore Files - How to, Technology and PC Security Forum |

RozaLocker .enc File Virus – Restore Files

Article created to help remove RozaLocker ransomware and give tips on how to restore encrypted files with the .enc file extension, instead of paying the 10000 rubles ransom.

A virus from the file encryption type has been reported by malware researchers to attack Russian-speaking users. The ransomware infection performs multiple different activities on the compromised computers. The malware is dubbed RozaLocker and drops a ReadMe.txt file after it infects a computer. The .txt file has a ransom note with demands to pay the sum of 10000 rubles which is approximately 170 US dollars. The cyber-criminals promise that after they receive a payment, they will decrypt the files, but it is strongly advisable not to make any payoff and instead read the following article carefully.

Threat Summary


.enc File Virus

Short DescriptionThis ransomware infection encrypts files on the compromised computer and asks the user to pay approximaely 170$ for the file recovery.
SymptomsThe user may witness ransom note, named ReadMe.txt and the important files on the computer may be encrypted.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by .enc File Virus


Malware Removal Tool

User ExperienceJoin our forum to Discuss .enc File Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

RozaLocker Ransomware – How Does It Infect

For the infection procedure, the virus may undertake a massive e-mail spam campaign, oriented towards Russian-speaking users. What is particularly interesting in this situation is that the RozaLocker threat may sent the spam messages with deceitful messages within them. Amongst the deceptive templates may be included claims the user has purchased something online and even claims that there is suspicious activity on his or hers paypal or bank account. The end goal of those e-mails is to open the e-mail attachments that cause the actual infection with RozaLocker. The e-mails sent may appear like the example image below:

But this is not the only infection method that may exist when it comes to this particular ransomware. It may also be uploaded in a hacked account of uploaders on torrent websites. Since accounts on these sites have usually a high rate of infection, reports often indicate that these accounts are hacked and malicious infectors may be uploaded through them. The infection files may pretend to be game patches, cracks and other fake installers, users believe are legitimate.

RozaLocker .enc Variant – Infection Activity

When a malicious file carrying the download script or RozaLocker has been activated, the virus may connect to a remote host. This is done with the one and only purpose of downloading the payload of RozaLocker and dropping the malicious files which later render most of the usable data no longer openable. The malicious payload dropped, may consist of the following files:

  • A setup.exe file with malicious scripts in it which may be the encryption module.
  • A ReadMe.txt ransom note of RozaLocker which has the payoff demands.
  • A qt_temp.Hp module.
  • A trainer.exe file which displays a pop-up.

Both the qt_temp and trainer file are located in the Windows directory. Other files may be scattered in numerous other folders:

  • %AppData%
  • %System Drive%
  • %System32%
  • %Temp%
  • %Local%
  • %Roaming%
  • %LocalRow%

Once the virus is ran on the computer, it asks the user from Windows Smart Screen to run the setup.exe file. In the event that the user is inexperienced enough and activates the setup.exe file, the virus displays a pop-up translating to “Game program from Sashi The Renderer”.

RozaLocker – The Encryption Procedure

The encryption process of RozaLocker involves altering the data of original files with symbols from the encryption algorithm used by the ransomware. The usually targeted files by RozaLocker may be Microsoft Office documents, image files, Adobe Reader files, music, videos and other files that may be of importance to the victim. If we have to sum it up, the virus may encrypt files that are often used, like the following file types:


After the encryption procedure has been completed, the encrypted files are rendered no longer able to be opened. They are also appended the .enc file extension after their original one and may look like the following image:

After the encryption process has completed, this ransomware virus also drops it’s ransom note which roughly translates to:

1) Find 10 000 (10 thousand) rubles, not less. Suitable for the following –
(Qiwi, Sberbank, Yandex.Money, Tinkoff Bank, VTB, but better Qiwi (faster)
2) In the browser, open the site – through this site you will transfer money
3) In the column I DELETE where you will translate (according to item 1) and above enter the amount – 10,000 rubles.
4) In the RIGHT I select Bitcoin and on top the amount should automatically be transferred to btc
5) In the column DATA ENTRY, fill in your requisites from where you will pay and where to transfer (Bitcoin wallet)
ATTENTION-ATTENTION, CORRECTly copy this number to a purse (yes, it’s so strange)
After inserting, carefully, again check whether it is copied correctly.
6) Click on GO TO PAY and follow the instructions on the site.
In a couple of hours we’ll write you on the desktop and return everything to you.
If there are difficulties, then write on the mailbox – [email protected]

Remove RozaLocker Ransomware and Try Getting Back .enc Files

Before attempting any removal of RozaLocker ransomware, recommendations are to back up the encrypted files before the actual removal takes place, just In case.

Then, for the removal process, we advise you to follow the removal instructions below. But in case you lack the experience and feel uncertain that you will fix all infected objects and remove the malicious ones manually, recommendations are to remove this ransomware infection automatically. One way to do this is via an advanced anti-malware software which will automatically remove RozaLocker ransomware and protect you from such threats in the future too,

For the file recovery of .enc files, encrypted by this virus, at the moment there is no direct free solution. However, paying the ransom is also highly inadvisable because it may not result in you getting your files back. This is why we recommend checking out some alternative methods that can recover a portion of your files. They are published in step “2. Restore files encrypted by .enc File Virus” and are no guarantee you will get all your data back, but you may get back at least a part of it.

Manually delete .enc File Virus from your computer

Note! Substantial notification about the .enc File Virus threat: Manual removal of .enc File Virus requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove .enc File Virus files and objects
2.Find malicious files created by .enc File Virus on your PC

Automatically remove .enc File Virus by downloading an advanced anti-malware program

1. Remove .enc File Virus with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by .enc File Virus
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share