MegaLocker Virus - How to remove

MegaLocker virus is a ransomware infection and that means it will prevent you from using your own personal files. It will do that by encrypting all of them. As a result, MegaLocker will require a certain amount of money ($800) to get your files back on track. This is why it is called ransomware and this is how typical ransomware works.

You might think that there are alternatives to paying the ransom, but actually, there are. The purpose of this article is to provide you with detailed instructions on how to completely remove this infection and retrieve files that belong to you.

Also, you will be introduced to the principles of ransomware and various distribution methods that can lead to infection, therefore you will be aware of dangerous situations in the future and will be able to avoid this happening. In case you have any questions related to this topic, feel free to ask them in the comments section below – we will do our best to answer them all.

How MegaLocker Works

Like a typical ransomware infection, has the one and only purpose – infect as many computers as possible, lock personal files stored on them by using complicated encryption algorithms and then require a ransom to be paid in order to provide a decryption key that could reverse the encryption algorithm and make those files usable once again.

So let’s say MegaLocker virus manages to get inside of your computer, what happens next? First, it will scan your hard drive to indicate files that could be encrypted. Regrettably, it can encrypt almost all file types that are used commonly, so all of your photos and videos, text documents and similar files will be ’encrypted’.

All affected files will be marked with “.crypted” extension at the end. That means you won’t be able to open or use those files in any other manner from that moment. Immediately after that, you will notice a new file on your desktop named “! DECRYPT_INSTRUCTION.TXT”. It is a ransom note and it goes like this:

What happened to your files?
All of your files were protected by AES cbc-128 using MegaLocker Virus.
What does this mean?
The files have been irrevocably changed,
read them or see them,
you can restore them.
If youíre on your computer, youíll be able to return your files.
What do I do?
You can buy a decryption of $ 800 for a private person.
But before you pay, you can make sure that you can decrypt any of your files.
Send us 1 random encrypted file to [email protected] , a maximum of 5 megabytes, we will decrypt them
and we will send you back. Do not forget your 23: –
You can check the decryption of more than one file, but no more than 3.
There should be only one file for each letter!
If you are a private person, then send your private photo (birthday, holidays, hobbies and so on),
you will pay $ 250 for decrypting files.
If you are not a private person, do not try to deceive us !!!
Do not complain about their email addresses!
After confirming the decryption, you must pay in bitcoins. We will send you a bitcoin wallet along with the decrypted file.
You can pay bitcoins online in many ways:
https://buy.blockexplorer.com/ – payment by bank card
https://www.buybitcoinworldwide.com/
https://localbitcoins.net
About Bitcoins:
https://en.wikipedia.org/wiki/Bitcoin
If you have any questions, write to us at [email protected]

We have already mentioned that cyber criminals behind MegaLocker want you to pay $800 for the decryption key. However, they pretend to be generous and offer a discount if you are a “private person” – then you shall pay only $250. However, to be able to use this privilege, you will have to prove them your identity by providing some personal information to their email address at [email protected]. Obviously, providing cyber criminals with your personal information is never a good idea.

Distribution Methods of MegaLocker

MegaLocker might be infiltrated into your computer in several different ways. However, all ransomware infections are distributed really similarly. We have examined infections like Crypted034, FileEncrypted, or LOVE virus and they all are distributed in a very similar manner.

The highest probability to get infected with MegaLocker is by opening a spam letter with malicious files attached to it. Basically, cyber criminals just sent out millions of emails to random email addresses with some well-crafted letters that encourage to open the attached file that might be opened to access important information. After that, it turns out that the attached file was a payloader of the virus and that’s all it takes to get infected with MegaLocker.

Also, it is possible to get infected with this malware just by clicking on some excessive advertisement displayed on a website of questionable reputation. That’s why we always recommend to keep your computer secured with reliable anti-malware software and stay away from unreliable websites.

How To Eliminate MegaLocker Virus

There are two things you need to do in order to solve problems related to MegaLocker Virus. First, you need to completely remove the virus from your computer and then use a backup file to restore your files.

First of all, please scan your system with Spyhunter. Either one of those programs should be able to immediately detect and eliminate MegaLocker ransomware.

Then, you should perform a system restore to retrieve your personal files. This way you will be able to get them back without paying a ransom. Detailed instructions on how to do that are provided below.

Automatic Malware removal tools

How to recover MegaLocker Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before MegaLocker Virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of MegaLocker Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to MegaLocker Virus. You can check other tools here.  

Step 3. Restore MegaLocker Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually MegaLocker Virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover MegaLocker Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.