Evil Locker Ransomware

Evil Locker Ransomware is yet another ransomware infection that tries to rip poor victims off. Ransomware programs encrypt target files and make it impossible for users to access their data. They virtually hold user’s files hostage, waiting for the affected user to pay the ransom. However, no one can guarantee that these people would issue the decryption key even if you transfer the ransom. Therefore, it is far more important to remove Evil Locker Ransomware from your system right now. It is very likely that you can recover at least some of your files, so you should never depend on the false hope given by these criminals.

Like most of the ransomware infection, this program should also spread through spam email messages. It is also very likely that it targets small businesses and companies rather than individual users. That is because companies are more likely to pay the ransom in order to retrieve their files. They might be especially desperate if they do not have a file backup. Therefore, to avoid such infections, companies should invest in educating their employees about NOT OPENING unfamiliar emails from unknown senders. That is actually the best way to protect yourself from a ransomware infection, but users seldom understand the danger behind an attached file.

If by any chance, Evil Locker Ransomware manages to enter the target computer, then it will behave just like most of the ransomware infections. It will first scan the system looking for the types of files it can encrypt. Judging from the research compiled by our team, the program can encrypt most of the files that are saved in the %UserProfile% directory. In other words, all your photos, documents, videos, audio files, programs will be successfully encrypted, and you will not be able to open them anymore. What’s more, if the different file icon weren’t enough, Evil Locker Ransomware also adds an appendix to the encrypted file. For example, if there were a crow.jpg file in your directory, after the encryption, the filename would look like crow.jpg.[evil@cock.lu].EVIL.

Perhaps it is a bit of a relief that Evil Locker Ransomware does not drop additional files on the target system. It means that it does not lock up your screen, and it does not display the ransom note every single time you turn on your computer. It only drops the ransom note in a text file under the !_HOW_RECOVERY_FILES_!.txt filename. The ransom note itself does not differ much from your regular notification:

HELLO, DEAR FRIEND!

1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ] Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the decryption program.

2. [ HOW TO RECOVERY FILES? ] To receive the decryption program write on our e-mail: evil@lock.lu or evil@firemail.cc And in subject write your ID: ID-xxxxxx We send you full instruction how to decrypt all your files.

As you can probably tell, the criminals expect you to contact them, so they could tell you more about the payment process. The chances are that the people behind Evil Locker Ransomware will ask you to pay the ransom in Bitcoin, as that is the hottest cryptocurrency these days. They will also tell you that you will receive the decryption tool the moment you pay the ransom, but that is highly questionable. In fact, there is also a possibility that you will not be able to contact these people in the first place. Note how there are two email addresses in the ransom note. It means that one might not be enough, that their servers could go down any moment.

You should not fall for these dirty tricks. Simply remove Evil Locker Ransomware from your computer, and then look for ways to restore your files. If you search the web and you find a public decryption tool for this infection, you can use it. If you have a file backup in an external hard drive, you can simply delete the encrypted files, and transfer healthy copies into your computer. You might also have certain copies of your files saved on your mobile device or cloud storage. However, please bear in mind that in some cases it might not be possible to restore your data. Thus, you have to prevent similar infections from occurring in the future.

How to Remove Evil Locker Ransomware

1. Go to your Downloads folder*.
2. Locate the most recently downloaded files.
3. Delete the files.
4. Scan your computer with SpyHunter.

* Or another directory where you save downloaded files.