Locky is a malware that encrypts the personal files in the infected computers. The encryption is so strong that it can’t be open without the actual encryption key. You are asked to pay a huge amount to get the encryption key. That makes the Locky Malware a ransomware. It is distributed through a fake email containing a word file. This word file is labeled as an invoice of pending payment. You get worried about the payment and open the word file to see. This word file contains unusual texts and a note 'enable macro if data encoding is incorrect'. Once you enable the macro the Locky virus enters in your system and start encrypting your files. Now you start noticing that your important files are changed into a different file name with .locky extension. It can’t be opened. You also see a note on your desktop to install the tor browser and open a website to see the instruction to get your files back. This website demands money to get your files back.

Not only this, the makers of Locky ransomware released few other strong versions of this malware. These new versions include methods to hide so that anti-malware and anti-viruses can’t detect them. The other version of this ransomware uses .odin and .thor extensions to encrypt the files. This malware comes into the limelight in 2016 when more than half million people were infected. As of now, there is no proven method to decrypt the files infected with Locky ransomware. However, the virus can be removed from the computer but to get your files back the only left method is either paying ransom or try to recover your files using recovery software. In this guide, we will help you to remove the Locky Ransomware and tell you how to restore your windows to previous date so that you can get your files back. 

What is Locky Ransomware?

How Locky Ransomware gets into your System?

Locky Ransomware is spread through fake email. This email contains an attached word file named invoice and you are suggested to make the payment for some service. In curiosity, you download this word file and open it. You see some random characters in the word file and a note saying ‘Enable macro if data encoding is incorrect’. You enable the macro and then it gets into your computer. Macro is a small code that expands automatically to perform larger tasks. It automatically gets expanded and initiates the download process of a ladybi.exe on your computer. This is the actual Locky Virus. Just after downloading the macro execute this file. Now Locky Ransomware creates registry entry so that it can do its targeted task automatically.

Now it starts scanning for personal files on your local hard drive and network shared drives.

After scanning the files it starts encryption process. You files are changed to random 32 characters with .locky extension. You can’t open these files. Locky also add text file contain the instruction to recover your files named “_Locky_recover_instruction.txt”

It also adds a note on your desktop that all your files are encrypted and follow the instructions to get your files back. When you follow the instruction it offers to download the Locky Decrypter which cost 0.5 Bitcoin. Some user also gets 1 Bitcoin ransom amount. The makers also include an instruction to how to pay the money in Bitcoin to them.

Step 1- Install MalwareFox on your PC

Open the Installer by Clicking on the Downloaded file.

Now choose your desired language and follow the instructions to install the MalwareFox on your computer.

After completing the installation, the MalwareFox will update the application to its latest version. Let it update.

Now it will sync the Malware database with server. It is important step as it needs to know latest types of malwares.

Step 2 - Scan and Clean your Computer for Malware

When the update process completes it will show Real Time Protection: On. Now you can scan your computer. Press Scan button and leave everything on MalwareFox, it knows how to deal with Locky Ransomware and other malware.

After the scan complete click on Next button to clean your computer completely.

Recover your Files using Recovery Software

Some users successfully removed the Locky ransomware and got their files in original state in the first step. But some users didn't get their files even after scanning with anti-malware. The MalwareFox can detect and remove the Locky from your computer but it can't decrypt your files. No software can do this task as of now. 

We have seen in our testing that sometimes recovery software like Recuva successfully recovers the files. There are plenty of other recovery software also, you can search on the internet. Your files didn't completely remove from your hard drives. The recovery software finds the traces and successfully recover files. It is worth trying them for once at least.

How to not get Infected with Locky Ransomware?

If you were lucky getting your files back then surely you never want any other such malware attack on your PC. You should always double sure before checking any email and downloading any attached file. The main process to not get infected with this malware is stop its distribution process. It is mainly distributed by spam email with an attached word file containing the macro. So don't download any file from the person you don't know and keep the macro turned off. If you want to stay protected from Locky Ransomware and other malware then install MalwareFox and keep the Real-time protection on.