AutoLocky Ransomware Removal

How to Remove AutoLocky Ransomware?

AutoLocky is part of the ransomware family. These types of infections are meddlesome, dangerous, and quite harmful. They prey on your panic and naivety and exploit you for monetary gains. AutoLocky slithers into your computer, takes your data hostage by encrypting it, and claims that if you wish to see it again, you have to pay a ransom. It’s the first infection of its kind that takes advantage of the AutoIt programming language to perform the data encryption via the RSA-2048 and AES-128 cryptographic ciphers. What’s more, it’s not dependent on Trojan’Droppers to plant it on your computer, but it’s rather a self-contained ransomware distributed to users as a PDF file with a double file extension. Once the nasty tool invades your system, it doesn’t take up much space and resources, which allows it to fly under the radar, and many security scanners miss its presence. The only red flag, which reveals its position is the slower computer performance you’ll have to bear. But once its programming kicks in and it begins doing what it’s designed to do, there is NO way you can miss it. And, while some things differ from the common behavior of ransomware, others remain the same. All of a sudden, you’ll find each one of your filed encrypted, with an added .locky extension, which will render it inaccessible. You’ll be greeted by a ransom demand, stating that if you wish to receive the decryption key to free your files, you have to pay up. And, if you don’t, you lose your files. It’s a rather simple scheme, but it’s one that works. When faced with a choice of ‘pay and regain your data’ and ‘don’t pay and lose it,’ most users choose the first. Don’t be part of that group of users. Believe us when we say that the war with AutoLocky is one you CANNOT win. The game is rigged against you from the start. Accept defeat and forsake your files. They’re replaceable while your privacy is not. And, if you pay the requested ransom, it will be like handing over your personal and financial information to strangers with malicious intentions. So, don’t. Make the more difficult, but right, choice.

How did I get infected with?

AutoLocky cannot just appear on your computer one day as if by magic. There’s nothing magical about the way it showed up. If you want someone to blame for the ransomware’s popping up, blame yourself. Oh, yes. You take the fall for this one. Do you know why? Well, infections like AutoLocky are required to ask you whether you permit their installment before they enter your system. And, if you don’t – no admittance. But, evidently, you complied. Otherwise, you wouldn’t be in your current predicament, dealing with the colossal mess, which the tool has placed upon you. To successfully sneak in undetected, AutoLocky turns to the old but gold means of infiltration as they’ve proven their effectiveness over time. Apart from the PDF method of invasion, the most commonly used methods include hiding behind freeware or spam email attachments, corrupted links or sites or pretending to be a bogus update. Do you see the shared characteristics between each one of these? They all rely on your distraction, naivety, and haste! Understand that infections prey on carelessness. So, if you provide it, don’t be surprised to find an unwelcomed guest like AutoLocky on your PC. It’s imperative to be extra careful and thorough when installing tools or updates. Always do your due diligence, and remember that even a little extra attention today can save you a ton of troubles tomorrow.

Why is AutoLocky dangerous?

AutoLocky can affect up to fifty file types. Fifty! That’s fifty different variants of documents, pictures, videos, etc., you have saved one your computer – JPEG, PNG, JPG, MP4, AVI, MOV, MP3, DOC, DOCX, PDF, HTML, TXT, XML, and so on. You get the point. Chances are, every single file you have stored on your computer, WILL be affected by the dreaded tool. And, once the ransomware encrypts it, there will be no opening it. The files are rendered inaccessible, and the only way to free them from AutoLocky’s hold is to apply the decryption key. But to get it, you have to comply with its demands. They’re simple enough: pay 0,75 Bitcoins, which is about $320. But ask yourself this: Can you trust these people? And, the answer is pretty evident: No. No, you cannot. These are unknown individuals, who have made their way into your computer via deception and finesse. People, who have taken your data hostage, and requested you pay money for their release. Do you honestly believe they’re trustworthy and will keep their end of the bargain? Don’t be naive. There are several scenarios the exchange can go down, and neither one ends well for you. Let’s say you do pay these $320 despite experts’ advice. What then? What if they don’t send you a decryption key? You’ll find yourself with your data still encrypted and with less money. Not to mention, by completing the transaction, you open the door to your private details to these wicked people. Who knows what can follow. Or, what if you do receive a key to decrypt the files, but it fails to do the job as it’s fake? Or, what if it works, and you decrypt everything, but AutoLocky’s programming kicks in again tomorrow, and you find yourself back to square one? There are plenty of ‘what ifs’ and, as you can see, they all end badly for you. So, do the right thing. Don’t fight a battle you cannot win. You have no chances of success because the people you’re facing aren’t playing fair. Do the wiser thing – pick your privacy over your data. You may not see it now, but it’s truly for the best.

AutoLocky Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover AutoLocky Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with AutoLocky encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate AutoLocky encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.