Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Please Help : Unable to Remove Locker v4.4 from 2015


  • This topic is locked This topic is locked
4 replies to this topic

#1 Ammce

Ammce

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 AM

Posted 27 March 2018 - 10:28 AM

Dear forum members,

In 2015. I got a malware that has been present in my computer since then. All memories of my life are encrypted and I am not able to access any of the pictures. You can imagine how important it is for me to remove encryption from these files. I have tried many things, but it simply doesnt work. I will upload the picture down bellow of the screen I got when I got the ransomware and I will provide a Ransomware file if somebody wants to check what is going on. I tried to detect what it is Ransomware, but It couldn't detect it, so that is why I am here now.

I uploaded Ransomware encrypted file(image) if somebody wants to discover what it is on this link: http://www89.zippyshare.com/v/BpbZOt04/file.html

Please help me

 

This is what message I got back there: https://imgur.com/a/4q4PE

 

Note from ID-Ransomware: Please reference this case SHA1: fc99c81345e8f7b30650c99cc01b6f6975a0fb8f


Edited by Ammce, 27 March 2018 - 10:34 AM.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,954 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:36 AM

Posted 27 March 2018 - 02:01 PM

There are a couple ransomwares that use the name Locker/LockeR. From what I recall Locker first appeared around mid-May 2015, used random version numbers and did not append file extensions. LockeR Ransomware appeared around mid-October 2017, appended the .locked extension to the end of encrypted data filenames and left files (ransom notes) named [How_To_Decrypt_Files].html.

Please be patient until Demonslay335 has a chance to review the case SHA1 you provided. Bleeping Computer is inundated with support requests and he is not logged in at the moment.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:02:36 AM

Posted 27 March 2018 - 03:09 PM

xXToffeeXx identified it as this "Locker" from 2015.

 

https://www.bleepingcomputer.com/virus-removal/locker-ransomware-information

 

There was a decrypter published by Nathan Scott in the article, but I don't know if it works on all versions of it. Worth a try on some test files.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#4 Ammce

Ammce
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 AM

Posted 27 March 2018 - 03:25 PM

Dear Demonslay335, I have followed the links you provided even before I opened a topic, but it seems that all links towards LockerUnlocker.exe are broken and there is no support anymore for it. I spent last 12 hours trying to find a solution and it seems I wont be able to contact him. It is a locker from 2015, and in that time I did not know what happened, but I googled it recently since I needed some files. I just thought I need to open it with some program or something.

Please, do not tell me that my files are gone forever :(



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,954 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:36 AM

Posted 27 March 2018 - 03:25 PM

Since the infection has been identified, rather than have everyone with individual topics, it would be best (and more manageable for staff) if victims posted any more questions, comments or requests for assistance in the below support topic discussion.Note: Locker Unlocker was a tool created by Nathan Scott (DecrypterFixer) for victims of Locker Ransomware and hosted on his EasySync website which has since been closed. Nathan stopped support of his tool and it is no longer available for download. Nathan moved on to other projects which included CryptoMonitor, Malwarebytes Anti-Ransomware Beta and Malwarebytes 3.0. Nathan is now the Technical Project Manager at Malwarebytes. You can try contacting him at Decryptorbit@outlook.com, linkedin.com/in/NathanMScott or Malwarebytes and ask if he can provide you with some other download link.

To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users