ForceLocker Ransomware

What is ForceLocker Ransomware?

ForceLocker Ransomware is a malicious application targeting Russian users primarily. It seems to be a new version of ShellLocker, a ransomware infection detected by specialists some time ago, because they are similar to each other. The first thing ForceLocker Ransomware does on users’ PCs after the successful infiltration is encrypting personal files. Then, it locks Desktop by placing a screen-locking window with a ransom note on it. It becomes clear after reading the message left on the screen that all this threat wants from users is their money. Of course, you should not send a ransom no matter how badly you need your files back. What we recommend doing instead is simply deleting this infection from the system and then recovering files from a backup. We have to tell you the truth – it might be impossible to restore files if you do not have a backup of files because the encryption key AES-256 which it uses is one of the strongest encryption algorithms.

What does ForceLocker Ransomware do?

Not much is known about the distribution of ForceLocker Ransomware, but there is no doubt that it enters computers without permission. Following the successful infiltration, it finds where users’ files with such extensions as .cpp, .pas, .bmp, .jpeg, .avi, .bat, .ots, .crt, .pfx, .key, .djvu, .vbs, .sql, .mov, and others are located and then locks them all by changing their original extensions to .L0cked. It also changes their names to alphanumeric symbols, for example, picture.jpeg might become ESOLUzZWB.L0cked. Users cannot check whether their files have really been encrypted and they do not even notice that they look differently because ForceLocker Ransomware places a screen-locking window on Desktop after infiltrating the computer and encrypting files. This window contains a ransom note which explains why files can no longer be opened. Also, users are told that only a private key can unlock their files. This message does not contain any instructions explaining how to get this decryption key, so we suspect that users will get more information only when they contact cyber criminals by the provided email address 5quish@mail.ru. That is, the size of the ransom will be specified, and users will be explained how to transfer the money required. You should not even contact them if you are not going to purchase the decryption key. We have high hopes that you will make a smart decision and keep your money to yourself.

A bunch of encrypted files on your PC is not the only sign showing that ForceLocker Ransomware is inside the system. Once it enters the system, it also drops a file svchost.exe in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup. Many users wonder how such infections as ForceLocker Ransomware manage to enter their computers, but the explanation is very simple – they are distributed via spam email campaigns. Users often allow these infections to enter their PCs by opening spam email attachments. Of course, they know nothing about that. Research has shown that users might download ransomware infections from untrustworthy pages containing free software as well. Delete ForceLocker Ransomware no matter how it has entered your system. Do not forget to enable a security application on your PC after its deletion because another infection might illegally enter your PC again and lock your files one more time. Of course, ransomware is not the only type of malware actively spread nowadays.

How to delete ForceLocker Ransomware

You will not unlock your files by removing ForceLocker Ransomware from your PC, but you still cannot keep this infection active on your system because you could not normally use your computer due to the presence of the screen-locking window placed by ForceLocker Ransomware on Desktop. Since this threat starts working automatically again after the system restart, you will not unlock your screen by rebooting your computer. What you need to do is to boot into Safe Mode first and then delete this infection from your PC. Our manual removal guide should help you to manually delete this infection; however, if you find the manual method quite challenging, you should use an automatic scanner to remove ForceLocker Ransomware automatically. If you are planning on using an automatic tool, you should boot into Safe Mode with Networking so that you could download it from the web.

Delete ForceLocker Ransomware manually

Boot into Safe Mode/Safe Mode with Networking

Windows XP/Windows Vista/Windows 7

1. Restart your computer and then start tapping F8 on your keyboard.
2. Select Safe Mode or Safe Mode with Networking using arrow keys from the Advanced Boot Options window.
3. Press Enter.

Windows 8/8.1/10

1. Press Win+I simultaneously and click Power.
2. Press and hold the Shift key.
3. Click Restart.
4. Select Troubleshoot and click Advanced Options.
5. Open Startup Settings and tap Restart.
6. Press F4 (Safe Mode) or F5 (Safe Mode with Networking).

Remove ForceLocker Ransomware

1. Press Win+E simultaneously.
2. Type %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup in the address bar and press Enter.
3. Locate svchost.exe and delete it.
4. Remove all shady files from %TEMP%, %USERPROFILE%\Downloads, %APPDATA%, and %USEPROFILE%\Desktop.
5. Empty the Trash bin. Download Removal Tool100% FREE spyware scan and
   tested removal of ForceLocker Ransomware*