How to Remove $ucyLocker Ransomware

$ucyLocker ransomware is an encryption Trojan virus that appends .WINDOWS file extension to your original files’ names. This new ransomware is a variant of the HiddenTear. HiddenTear is an open source platform that was created way back in 2015 for “educational purposes”, however, cyber criminals found a way to exploit this open source program to create infections like the $ucyLocker ransomware. This ransomware communicates with the Command and Control services and passes on information about your infected computer and receives the required data to carry out the attack. It then starts to scan your computer for the following file extensions:

.3gp, .7z, .apk, .avi, .bmp, .cdr, .cer, .chm, .conf, .css, .csv, .dat, .db, .dbf, .djvu, .dbx, .docm, ,doc, .epub, .docx .fb2, .flv, .gif, .gz, .iso .ibooks,.jpeg, .jpg, .key, .mdb .md2, .mdf, .mht, .mobi .mhtm, .mkv, .mov, .mp3, .mp4, .mpg .mpeg, .pict, .pdf, .pps, .pkg, .png, .ppt .pptx, .ppsx, .psd, .rar, .rtf, .scr, .swf, .sav, .tiff, .tif, .tbl, .torrent, .txt, .vsd, .wmv, .xls, .xlsx, .xps, .xml, .ckp, .zip, .java, .py, .asm, .c, .cpp, .cs, .js, .php, .dacpac, .rbw, .rb, .mrg, .dcx, .db3, .sql, .sqlite3, .sqlite, .sqlitedb, .psd, .psp, .pdb, .dxf, .dwg, .drw, .casb, .ccp, .cal, .cmx, .cr2.

After it looks for several file extensions, it starts the encryption process. The $ucyLocker ransomware uses a strong encryption algorithm in encrypting your files so it would really be hard to recover them. That’s why whenever you can, make sure to create copies of your important files in case something like this happens so that you won’t have a hard time looking for a decryption key to decrypt the files. Moreover this threat also blocks your Task Manager to make it hard for you to stop it. Luckily, your screen is not locked so there is still a way to enable your Task Manager, this as well as the removal instructions will be discussed later on. Once the encryption is done, the $ucyLocker ransomware displays a text file entitled READ_IT.txt that contains this message:

“Your files have been encrypted.

Read the Program for more information

read program for more information.”

And then the ransomware displays its main ransom message through a program window which includes three different messages containing the instructions in paying the ransom. The following are the messages on the ransom note that the $ucyLocker displays:

“Your computer is locked. Please do not close this window as that will result in serious computer damage

Click next for more information and payment on how to get your files back.

$usyLocker

‘Your Files are locked. They are locked because you downloaded something with this file in it. This is ransomware. It locks your files until you pay for them. Before you ask, Yes we will give you your files back once you pay and our server confirm that you pay.

Next’

‘I paid, Now give me back my files

Send 0.16 to the address below

[34 RANDOM CHARACTERS]

bitcoin

ACCEPTED HERE”

This kind of infection is usually distributed through malicious spam messages which are sent with in the guise of important or legitimate notifications usually for invoices, purchase requests, receipts, etc. These malicious emails carry either a suspicious web link or another infected file extensions.

This ransomware will demand you to pay 0.16 BitCoin which is approximately equal to $450 which you shouldn’t pay obviously. No matter how desperate you are, paying the ransom should be a no go. Instead, you can try out our removal instructions below to get rid of $ucyLocker ransomware.

Eliminating $ucyLocker ransomware:
Step 1: Enable the Task Manager.
1. Tap Win + R and then type in gpedit.msc to open the Local Group Policy Editor window and click OK.
2. Open the following settings by using the directory structure on the left:
User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options
3. Double-click the “Remove Task Manager” option.
4. Mark “Disable” or “Not configured” from the radio buttons.
5. Click OK and exit the editor.
6. Restart your PC for the change to take effect.

Step 2: Open Windows Task Manager by pressing Ctrl + Shift + Esc at the same time.

Go to the Processes tab and look for any suspicious processes and then kill them.

Step 3: Open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.

Step 4: Look for $ucyLocker ransomware or any suspicious program and then Uninstall.

Step 5: Hold down Windows + E keys simultaneously to open File Explorer.
Step 6: Go to the directories listed below and delete everything in it. Or other directories you might have saved the file related to $ucyLocker ransomware.

%USERPROFILE%\Downloads
%USERPROFILE%\Desktop
%TEMP%

Step 7: Look for the following malicious executable files:

$ucyLocker.exe
VapeHacksLoader.exe
{random 0-9 A-Z file names}.exe

Step 8: Right-click on it and click Delete.
Step 9: Go to desktop and delete READ_IT.txt.
Step 10: Empty the Recycle Bin.
Step 11: Try to recover your encrypted files.

Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if the $ucyLocker Ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.

To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Step 12: Perform a full system scan using SpyRemover Pro.

Turn on your computer. If it’s already on, you have to reboot it.

After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit Enter.

Windows will now load the Safe Mode with Networking.

Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.

Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading SpyRemover Pro. Installation will start automatically once download is done.