HappyLocker Ransomware

HappyLocker Ransomware is a release variant of HiddenTear Ransomware, a dangerous computer infection whose primary objective is to secretly infect your PC, encrypt your files and demand money to decrypt them. However, instead of complying with the demands, you should remove it from your PC entirely. While there is no free third-party decryption tool, we do not recommend that you pay the ransom because there is no guarantee that you will get the promised decryption program. To find out more about this infection, we invite you to read this whole article.

Since this particular ransomware is relatively new, there in little to no information about its distribution methods. Nevertheless, we assume that it is most likely distributed on infected websites with exploit kits that download it on your computer via your web browser when you interact with Java or Flash-based content. Furthermore, it is also possible for it to be distributed via email spam that should be sent from a dedicated server. The emails should contain an attached malicious file that drops the main executable of this ransomware or a direct download link to the said executable.

It seems that this ransomware was designed to run automatically upon infection and immediately start encrypting the files of the infected computer. Our research has revealed that it uses the AES encryption algorithm which is very strong and that is the reason there is no free third-party decryption tool. In any case, HappyLocker Ransomware was designed to encrypt many file types that include but are not limited to .mid, .wma, .flv, .mkv, .mov, .avi, .asf, .mpeg, .vob, .sxi, .otp, .odp, .wks, .xltx, .xltm, .frm, .odb, .dbf , .mdb, and .sql. Indeed, this particular ransomware was configured to target many file types and encrypt them in nearly all locations on your computer. We have found that it appends the encrypted files with the .HAPPY extension. Once the encryption process is complete, this ransomware will ask you to pay 0.1 BTC. The sum asked for decrypting your files is not outrageous since 0.1 BTC is 73.5 USD. Nevertheless, you can lose this money because there is no way of telling whether the developer of this ransomware will actually decrypt your files.

HappyLocker Ransomware is set to drop a ransom note that is an image file named READ.png and a text file named READDDDDDD.txt that features the same text. The ransom note says that your files were encrypted with HAPPY Ciphers and that need to go to http://ysasite{.}com/happy and follow its instructions. As mentioned, you are required to pay the ransom in Bitcoins to the Bitcoin wallet address featured on this website. This site even recommends platforms om which you can buy Bitcoins. Even though this ransomware has a rather reassuring payment system, there is still no guarantee that you will get the promised decryption key. The decision on whether to pay the ransom is completely up to you, but we suggest that you do not take the risk and delete this ransomware.

There is no question that HappyLocker Ransomware is malicious application because it is distributed in a malicious manner and its features are as malicious as they get. It was designed to encrypt your personal files and demand that you pay a modest ransom to get your files back, but there is no telling whether you will actually receive the promised decryption key. Therefore, we recommend that you remove this ransomware from your computer as soon as possible. You can use our featured antimalware application called SpyHunter, or our manual removal guide provided below this article.

Removal Instructions

1. Go to the Downloads folder.
2. Find Instant Satoshi BOT, right-click it and click Delete.
3. Go to the desktop and delete READDDDDDD.txt and READ.png
4. Empty the Recycle Bin.