Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.



  • This topic is locked This topic is locked
2 replies to this topic

#1 santare


  • Members
  • 227 posts
  • Local time:04:11 AM

Posted 15 April 2016 - 11:06 AM

I was reading an interview on a website and I wanted to use google translate but it didn't work.
Then I decided to copy paste the url and it translated the text, but it
froze in between. When I returned to desktop I saw my icons
encrypted with locky and file names are renamed A0. The computer
is slow, I had to stop two 326 processes in taskmanager.
I am currently running recuva I tried with shadow explorer but c drive is empty
while d is not. Desktop has txt icons which afe encrypted but pdf is not. I downloaded
Panda ransomware which tried to decrypt but I don't have any original files
Every file encrypted has created and modified entry as today's date. Mbam didn't recognize
anything. Frst didn't see 326. Will it encrypt further if I shut down?

BC AdBot (Login to Remove)


#2 santare

  • Topic Starter

  • Members
  • 227 posts
  • Local time:04:11 AM

Posted 15 April 2016 - 01:58 PM

I found locky in registry, what can I do about it.

#3 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,771 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:11 AM

Posted 15 April 2016 - 04:31 PM

Any files that are encrypted with Locky Ransomware will have the .locky extension appended to the end of the affected filename and leave a file (ransom note) named _Locky_recover_instructions.txt. When Locky encrypts a file it will actually rename the file to the format [unique_id][identifier].locky...(i.e. something like F67091F1D24A922B1A7FC27E19A9D9BC.locky). Like CryptoWall, Locky completely changes the filenames for encrypted files to make it more difficult to restore the data. More information in this BC News article:Unfortunately, as noted by Grinler, the site owner of Bleeping Computer in the above news article...there is no known way to decrypt files encrypted by Locky.

There is an ongoing discussion in this topic where you can ask questions and seek further assistance but as noted above there is no solution to fix your encrypted files.When or if a solution is discovered, that information will be provided in this support topic and you will receive notification if subscribed to it. In addition, a news article most likely will be posted on the BleepingComputer front page.

Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in the above support topic discussion. Doing that will also ensure you receive proper assistance from our crypto malware experts since they may not see this thread. To avoid unnecessary confusion...this topic is closed.

The BC Staff
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users