Do you know what KoreanLocker Ransomware is?
If you live in Korea, beware of a new threat called KoreanLocker Ransomware. This infection is not unique, in a sense that it was built using the same code as Genocheats Ransomware, Satan’s Doom Ransomware, and all other Hidden-Tear infections. In most cases, they are seen being spread via spam emails, and so you must be cautious when opening your inbox and checking your emails. Do NOT open emails that are listed as spam and those that are sent from unknown addresses and for unknown reasons. Even if the file or link attached to the suspicious email looks harmless – for example, it could look like a normal .PDF file – you should not open it. In fact, we recommend removing all strange emails right away. If you act carelessly, you could soon find yourself trying to delete KoreanLocker Ransomware, and that is not a fun task. While eliminating this threat can be complicated, decrypting the files that this malware corrupts might be impossible, and this is why you need to do everything to evade this malware.
Have you found your personal files in the %USERPROFILE% directory to have the “.locked” extension appended to their names? If that is what you are seeing, there is no doubt that KoreanLocker Ransomware has invaded your system. Once in, this malware immediately encrypts videos, music files, documents, archives, personal photos, and other content you want to keep safe. Although the threat does not delete files or leak them online, they are encrypted, which means that they cannot be opened. Once the files are locked, you are introduced to a ransom note via a file named “README.txt,” which you should find on the Desktop. The message within the file is written in Korean, which is what leads us to believe that only those speaking the language are targeted by KoreanLocker Ransomware. Do not worry about opening the file because it is not malicious; however, note that the information within it is not reliable, and you should not go on to do as told. Once you get to the removal part, do not forget to delete the ransom note file as well.
KoreanLocker Ransomware screenshot
Scroll down for full removal instructions
What would happen if you created a Bitcoin Wallet, purchased 1 Bitcoin (~12,000 US Dollars), and then transferred it to 1HB5XMLmzFVj8ALj6mfBsbifRoD4miY36v? This is that the creator of the malicious KoreanLocker Ransomware wants you to do, and that is made clear via the ransom note file. If you paid the ransom, you should get a decryption key, but, in reality, that would not happen. Another thing that the attacker instructs you to do is to email your ID represented via the ransom note to an unfamiliar email address, powerhacker03@hotmail.com. What happens if you do that? Unfortunately, your own address could be recorded in the process, and your inbox could later on be flooded with spam. Do not waste time trying to plead with cyber crooks either because that will not work. In general, if your files were encrypted and you found the ransom message, the main thing you should worry about is the removal of the devious KoreanLocker Ransomware.
Do you have backups for the files that were corrupted by KoreanLocker Ransomware? If you do, you should not postpone the removal for any longer. If you have no way of recovering files, you should look into a program named “Hidden Tear Decrypter.” It appears that this program allows decrypting files for free (if you enter the password abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ). All in all, whether or not you get your files back, you must remove KoreanLocker Ransomware, and this could be challenging. Are you capable of finding and deleting malware components? If you are not, it is best to use anti-malware software that is programmed to eliminate malicious threats automatically. The best part about using this software is that it also can provide you with full-time protection, which is priceless.
Delete KoreanLocker Ransomware
- Right-click and Delete the malicious {unknown name}.exe file.
- Right-click and Delete the README.txt file found on the Desktop.
- Right-click the recycle bin icon and choose Empty Recycle Bin.
- Perform a full system scan using a legitimate malware scanner to check if your system is clean.
In non-techie terms:
Do not postpone the removal of KoreanLocker Ransomware for any longer. This malicious threat was created to encrypt your files, and the only goal for cyber criminals behind it is to make you pay a ransom. Paying it is not the right move because you would be wasting money, and your files would not be unlocked. As you can see, deleting KoreanLocker Ransomware manually – if you know where the .exe file is – is not that complicated, but, in this case, your system remains vulnerable afterward. If you install an anti-malware program, your system is cleaned and protected at the same time, and so this is the option our research team recommends.