KillerLocker Ransomware

It is very disturbing when suddenly an image of a bloody clown appears on your screen, and it demands that you pay a ransom to restore your files. This is what KillerLocker Ransomware does when it enters your computer. This malicious ransomware infection behaves just like any other security threat from the same category. Ransomware programs are extremely annoying and dangerous because it is virtually impossible to restore the affected files. However, that should not discourage you from trying to remove KillerLocker Ransomware from your computer. It is a lot easier to get rid of this program than you think.

According to our researchers, this program is intended for the Portuguese market, and it may also target computer users in Brazil. However, the program does not spread in the wild as of yet. It seems that KillerLocker Ransomware is still in its testing stage. When a malicious ransomware program is still being tested by its creators, malware researchers can often get these types of programs from their testing phase. Also, sometimes cyber criminals infect a few computers with a particular underdeveloped malware application, just to see how the infection behaves and whether it connects to the command and control server. In other words, there is a good chance that this program will be released into the wild soon enough. Hence, it will definitely be useful to know how to deal with this infection.

It is very likely that, if the program gets released “officially,” KillerLocker Ransomware will be distributed via spam email attachments. These spam email messages will convince you that you have to download and open the attachment as it supposedly contains important shipping invoice or some other document you have to open immediately. Then, if you succumb to this, you will infect your computer with a dangerous ransomware program, and it will bully you into paying the ransom fee.

Let us take a closer look at the ransom note that appears on your screen. The note is accompanied with a creepy clown picture, which serves as a reminder that you are in trouble. The note is displayed in the Portuguese language, which also proves that the infection is intended for the Portuguese market. The message says that all of your archives were encrypted using the AES-256 encryption algorithm, and then it says the algorithm is very strong. Then it goes on to say you have to transfer your payment within 48 hours, but it does not give the amount yet (because the infection is still in the testing stage).

Nevertheless, KillerLocker Ransomware has a working payload, and it can encrypt target files. During our research we have found that the program encrypts every file it finds in the %ProgramFiles%, %APPDATA%, %LOCALAPPDATA%, Desktop, and My Pictures directories. Once a file is encrypted, it gets a new extension: .rip. Thus, it is very easy to discern encrypted and healthy files. The ransomware will leave most of the system files intact because it would not be able to contact is command and control center otherwise.

The message with the morbid clown can be closed just like any other window; it does not lock down your desktop. Also, the ransom note will slowly appear on your screen, just like it does for the Jigsaw ransomware. Since this rogram has not been released into the wild, it actually comes with the decryption password. The hardcoded decryption password can be found in the key.txt file that is dropped on your desktop. The password is chavekey12345678910, and you can use it to decrypt your files.

Nevertheless, just because it is possible to retrieve your data, you still have to take care of KillerLocker Ransomware. Please follow the instructions below to delete this infection. If you think that you can locate all the malware-associated files by yourself, you can scan your computer with the SpyHunter free scanner.

A full system scan will help you determine whether you need to remove any other malicious program. Do not be surprised if you find more dangerous threats on-board: malware programs seldom travel alone. Once you have your computer clean again, be sure to protect it from similar threats. That involves not only investing in a legitimate antispyware application, but also employing safe web browsing habits.

How to Delete KillerLocker Ransomware

1. Paste chavekey12345678910 into the Key box on the ransomware note.
2. Close the window and go to your Downloads folder.
3. Delete the most recently launched file.
4. Go to your Desktop and delete the key.txt file.
5. Scan your PC.