Princess Locker 2.0 Ransomware

Princess Locker 2.0 Ransomware is a new version of Princess Locker Ransomware. It shares similarities with its predecessor, so researchers at pcthreat.com have found out quickly what can be expected from this ransomware infection. It has turned out that it also wants victims’ money and, because of this, mercilessly locks victims’ personal files once it manages to affect their computers. It should be emphasized that the majority of users who find Princess Locker 2.0 Ransomware installed on their computers do not have a security application active on their systems and act quite carelessly. If you recognize yourself, we are not surprised that you have encountered this nasty ransomware infection. Without a doubt, the main goal this threat tries to achieve is convincing users to send a ransom to cyber criminals. As a consequence, this infection targets the most valuable files, including pictures, documents, videos, and music. It then drops files that contain the .onion link. You do not need to open it – we have checked it for you. This URL opens a ransom note. Cyber criminals might not give users the promised decryption tool, so they send money to them at their own risk. You should not be one of those users because you could do nothing if cyber criminals decide not to give you the promised decryptor.

You will sooner or later notice that Princess Locker 2.0 Ransomware has infiltrated your computer and locked your personal files because all your files will get a new filename extension appended. It has turned out that this ransomware infection appends a random extension consisting of letters and numbers, for example, file.jpg might become file.jpg.RLwpH3. There are other signs showing that the entrance of this ransomware infection was successful. You could locate several new files on your computer: =_THIS_TO_FIX_{random symbols}.txt, =_THIS_TO_FIX_{random symbols}.html, and =_THIS_TO_FIX_{random symbols}.url. The first two files contain the victim’s ID, personal extension, the link to download the Tor Browser and the .onion link, whereas the third one (=_THIS_TO_FIX_{random symbols}.url) links to http://royal25fphqilqft.onion/. The .onion website contains a message for users. Users are told that they can only unlock their files “with the help of special software” called Princess Decryptor. Of course, nobody is going to give it to users for free. The price of the special decryptor is 0.06000 Bitcoin, but if the payment is paid after the timer reaches zero, its price becomes 0.18000. It is up to you whether or not to send money to malicious software developers, but if you want to hear our opinion, sending money to cyber criminals is not what users should do. There might be no other ways to unlock files because a strong encryption algorithm was used to lock them, but you have no guarantees that you will really get the decryption tool and could use it to unlock your data after paying a ransom too.

Princess Locker 2.0 Ransomware is far from a prevalent ransomware infection, so it is still not very easy to talk about its distribution, but specialists at pcthreat.com have what to say about that. According to them, this ransomware infection should be spread exactly as its predecessor. That is, it should also be distributed as an attachment via spam emails. This is a popular distribution method used to spread all kinds of malicious applications, so you should stay away from all spam emails you get. On top of that, it is advisable to stay away from dubious file-sharing websites because they might contain malicious software pretending to be decent applications. To ensure the system’s protection, you should enable security software on it as well. An automated antimalware tool must be installed on users’ computers because it is the one that can prevent harmful threats they do not notice from entering their systems.

Users cannot leave a single malicious component belonging to the encountered ransomware infection active on their systems because this threat might start working again and cause more problems. Therefore, if you have already encountered Princess Locker 2.0 Ransomware, take action today. Since it does not create entries in the system registry and drops only .txt, .html, and .url files indicated in the 2nd paragraph of this article, its removal should not be a difficult task. Speaking specifically, you will just need to delete all recently downloaded suspicious files. If you cannot locate any of them, an antimalware tool will help you to clean the system.

Remove Princess Locker 2.0 Ransomware manually

1. Open Windows Explorer.
2. Go to the Downloads folder (%USERPROFILE%\Downloads).
3. Delete all suspicious recently downloaded files.
4. Remove .txt, .html, and .url files dropped by the ransomware infection.
5. Empty Recycle bin.
6. Scan your computer with a diagnostic antimalware scanner.