AdamLocker Ransomware Removal Guide

Do you know what AdamLocker Ransomware is?

Our malware analysts have recently tested a malicious program called AdamLocker Ransomware. They suggest removing it because it was configured to encrypt your files. However, it does not demand that you pay money to decrypt them. Oddly enough, this ransomware provides you with the decryption key. Nevertheless, its encryption is real, and your files can remain encrypted indefinitely if you do not take the necessary steps. You can decrypt your files free of charge and get rid of this ransomware. To find out more about it, we invite you to read this whole article.

AdamLocker Ransomware is by no means a legitimate application. It was developed by people who can get into deep trouble if there were identified. Currently, they remain at large and gleefully infect unwary PC users with their malware. At present, we do not know how this ransomware is distributed, but it is safe to say that if it infects your computer, then you will not notice it. If you have an anti-malware application, then it could stop it dead in its tracks. Still, our cyber security experts have a theory. They believe that, like many other ransomware-type applications, AdamLocker Ransomware is distributed through malicious emails.AdamLocker Ransomware Removal GuideAdamLocker Ransomware screenshot
Scroll down for full removal instructions

Indeed, cybersecurity experts assume that they have set up a dedicated email server that sends email spam to random email addresses in the hopes of infecting unwary users. We have received information suggesting that the emails feature an attached file that masquerades as a regular Word file, but one that demands that you enable macros to see its contents. Macros can be vulnerable, so malware developers develop ways to exploit them. In this case, the malicious Word file runs a script that secretly downloads AdamLocker Ransomware’s executable file named “run.exe” to %ALLUSERSPROFILE%.

Once on your computer, this ransomware will run immediately and create registry keys from its “.adam” file extension. The names of these keys are located at HKCR\.adam, HKCR\adam, HKLM\SOFTWARE\Classes\.adam, and HKLM\SOFTWARE\Classes\adam. Also, it will modify the registry key at HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System and change the value data from "0x00000000 (0)" to “0x00000001 (1)” of the value name DisableTaskMgr. Then, this ransomware will start encrypting your files and append them with its “.adam” extension. As a result, your files will be purposefully damage, and you will not be able to open them. It can encrypt close to a hundred file formats. For example, it can encrypt .txt, .jpg, .png, .bmp, .zip, .rar, .7z, .sql, .pdf, .tar, .mp3, .mp4, .flv, and .lnk files. As you can see, it targets file formats that are likely to contain personal and other valuable information. But, the good news is that once it has encrypted your files, it will render its graphical user interface window. If you click the “Open” button, it will open your web browser and load an adf.ly. After 5 seconds you will be able to click continue, and if you do, then you will be redirected to a side that will give you the decryption key. Then, it is a simple matter of entering the provided key into the dialog box of the GUI window.

If you want to remove AdamLocker Ransomware, then we suggest that you follow the instructions presented below, but not before you get the decryption key because if you delete it beforehand, then you will not be able to obtain it. This malicious program may be in its test phase, and that would explain why it gives the deception key. Nevertheless, it is dangerous, so feel free to make use of the removal instructions below or use an anti-malware program such as SpyHunter to get rid of it for you.

Delete registry keys

  1. Press Windows+R keys.
  2. Type regedit in the box and hit Enter.
  3. Go to and delete the following keys.
    • HKCR\.adam
    • HKCR\adam
    • HKLM\SOFTWARE\Classes\.adam
    • HKLM\SOFTWARE\Classes\adam
  4. Then, go to HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
  5. Find and delete the System sub key or find DisableTaskMgr, right-click it and replace the value data to 0x00000000 (0).

Delete the executable

  1. Press Windows+E keys.
  2. Enter %ALLUSERPROFILE% in the address box of File Explorer and hit Enter.
  3. Find run.exe, right-click it and click Delete.
  4. Empty the Recycle Bin.

In non-techie terms:

AdamLocker Ransomware is a highly malicious program that can encrypt your files with an advanced algorithm and effectively ruin your files. The good news is that it is currently configured to give you the decryption key for free, so make use to use this opportunity while you can and remove this ransomware after you have done that.