L0cked Ransomware

L0cked Ransomware ought to be a threat that encrypts files on the systems it infects, but our researchers report it might be still in the development stage since the malware was unable to lock anything during our tests. It is possible the malicious application could get updated in the future, but for now, it looks like users who encounter it should feel lucky none of their personal data got ruined. Nonetheless, keep it in mind the infection may still show ransom notes asking to pay for decryption even though the threat could fail to lock any files. Thus, before making any rash decisions, we strongly recommend to check your data and see if it can be opened. Either way, it is advisable to remove L0cked Ransomware as paying the ransom is always a risky option. To help users eliminate the malicious application faster, we will place instructions with detailed steps at the end of this text. Naturally, to learn more about the infection, you should just read the rest of our article.

We cannot say how the malware is being distributed, because truth to be told, we doubt it is being spread at all or at least actively. Since it appears to be unable to encrypt any files, it would make no sense to distribute it. There is a possibility less experienced users could get tricked if they do not check their data before deciding to pay the ransom, but we believe it to be a tiny chance. In any case, there are a few possible channels the hackers behind L0cked Ransomware could be using. For starters, the malware’s developers might send their victim’s infected email attachments. Usually, the one who receives it infects the system only after opening such a file, which means if you are cautious with suspicious data you should be safe. The other ways to spread the threat is to bundle it with installers of pirated software, freeware, and so on. Then the installers could be uploaded on various file-sharing web pages, promoted via pop-up ads, etc. This means to watch out for similar malicious application the user should stay away from doubtful web pages and unreliable installers as well as from emails sent by unknown senders.

Typically, the malware would identify its targeted data and then start the encryption process as soon as the victim opens its launcher. However, in this case, it looks like L0cked Ransomware fails to encrypt any data and yet it continues with showing the ransom note. According to our researchers, the malicious application should change user’s Desktop wallpaper with a file called BK.jpg. The picture is almost all black except a few sentences written in white and red. They claim the computer was hacked and the files on it were encrypted. Also, it mentions an email address the user should use to contact the hackers. The sentence in red warns not to turn off the computer or else it says the files will be lost forever. Besides, the image the victim might also see a pop-up window with another ransom note. It is supposed to ask to pay around 250 US dollars in Bitcoins.

To scare you the note may even threaten to double the price if you take too long to make a decision. Fortunately, you do not have to consider if your files are worth paying 250 US dollars and possibly losing them to the malware’s developers. As said before, the version of L0cked Ransomware that we encountered did not encrypt any files, and if you came across it as well, we recommend deleting it with no hesitation. To check if your files were damage just try to open them if you can do so your files are not locked.

The malicious application can be removed both manually and with automatic tools. If you choose the first option, we recommend following the instructions located a bit below as they could help you complete the task. Of course, it may appear to be a bit too complicated for some users in which case it would be advisable to install a reliable antimalware tool instead and perform a full system scan during which L0cked Ransomware should be detected. Afterward, you should be able to get rid of it together with other detections by pressing the provided removal button.

Erase L0cked Ransomware

1. Press Ctrl+Alt+Delete.
2. Go to the Task Manager.
3. Find the malware’s process.
4. Mark this process and click End Task.
5. Exit Task Manager.
6. Press Win+E.
7. Navigate to the folder where you downloaded the malware’s launcher, e.g., %TEMP%, %USERPROFILE%\desktop, %USERPROFILE%\downloads, etc.
8. Locate the threat’s launcher, right-click it and press Delete.
9. Copy and paste the following directory %PUBLIC%\Pictures into the Explorer.
10. Click Enter and find BK.jpg.
11. Right-click the mentioned picture and select Delete.
12. Close the Explorer.
13. Empty Recycle bin.
14. Restart the PC.