Remove Lock93 Ransomware

How to Remove Lock93 Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

Send the code to the e-mail
You will get payment instructions
After payment you will get the unlock code and your data will be decrypted

Do not delete or modify files with extension lock93 and virus files because it can
destroy your data

Price: 1000 RUR
E-mail: oplaticydadeng@mail.ru

Funnily enough, Lock93 Ransomware has nothing to do with Locky. According to researchers, this pest is related to CryptoLocker. It’s still a relatively new parasite, though, so it is yet to be explored. To date, what we could be absolutely positive about is that Lock93 Ransomware is harmful. All file-encrypting programs are. These infections are actually considered to be the most virulent thing currently online. Quite the title, isn’t it? Furthermore, the number of ransomware viruses on the Web is escalating. That is because ransomware is very effective when it comes to cyber scamming. Yes, you’re now stuck with this pest just so its developers could illegally extort money from you. It’s that simple. As soon as the Lock93 Virus gets installed, it scans your machine. This way the parasite locates your personal files and encrypts them. Pictures, music, Microsoft Office documents, videos, etc. Ransomware doesn’t discriminate. This particular program adds the .lock93 extension to the target data. Such a malicious appendix means that your personal information is inaccessible. You see, this is what ransomware does. By going after your data, it attempts to involve you in a nasty cyber fraud. Now, having all your files locked out of the blue is indeed nerve-racking. That is why many PC users give into their anxiety or panic. Yes, ransomware is a horrifying type of infection. Don’t let your nerves get the better of you, though. It might cost you a lot of money. As we mentioned, the Lock93 Ransomware locks your files. Thanks to its complicated encrypting algorithm, you’re now unable to use your data. And that’s not all. The virus creates a  “ИНСТРУКЦИЯ INSTRUCTION.txt” file on your desktop. In this file, you will find payment instructions. Just like its title, the ransom message itself comes in both Russian and English. Hence, the pesky Lock93 Ransomware aims mainly at Russian PC uses. You could get stuck with this virus anywhere on the globe, though. The ransom note claims “your data have been encrypted”. Also, a certain sum of money is demanded in exchange for a decryptor. Lock93 provides you two equally questionable email addresses – oplaticydadeng@mail.ru and zaplatiddeng@yandex.ru. Stay away from those. Contacting hackers is not an option as it would not solve your problem. On the other hand, it might make it a lot worse.

How did I get infected with?

The most likely scenario is that Lock93 Ransomware was sent to your inbox. Do you often receive spam messages and random email-attachments? You might be actually receiving dangerous infections. Clicking such a malicious email open is all you need to do in order to compromise your PC. What is the solution to that? Don’t click. Delete anything suspicious in your inbox and always keep an eye out for parasites. The Web is infested with malware. Furthermore, there are endless file-encrypting programs online which are just as harmful as Lock93. Avoid messages from unknown senders as well. Ransomware travels the Web bundled, via exploit kits, with the help of Trojans. Unfortunately, it’s almost impossible to know how exactly this nuisance managed to sneak in. Crooks have a rich variety of infiltration techniques to choose from. Watch out for potential intruders every single time you browse the Web. You won’t regret it.

Why is Lock93 dangerous?

As mentioned, this parasite’s instructions are simple and clear. You’re supposed to complete the payment if you wish to restore your locked files. Lock93 Ransomware demands 1000 Russian Ruble which equals about 17 USD. To say the least, this is quite an unusual sum for a ransom. Most viruses demand between 0.5 (324 USD) and 1.5 (973 USD) Bitcoin. Therefore, Lock93 is extremely modest in that department. According to the ransom note, you should not modify or delete the locked data. You have to pay. It’s rather clear that the parasite’s creators are simply trying to steal your money. Regardless of whether the ransom is 17 USD or more than 900 dollars, don’t comply. Remember that you DO NOT HAVE TO sponsor greedy, dishonest cyber criminals. Every single cent you pay would be used to support hackers’ illegal business. As a result, more ransomware infections will be developed. More innocent people will get scammed too. Apart from that, making a deal with crooks is a terrible idea that guarantees you nothing. Don’t be gullible and don’t turn into a sponsor of hackers. Take action instead. To get rid of the virus manually, please follow our detailed removal guide down below.

Lock93 Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Lock93 Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Lock93 encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Lock93 encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.