Your Files Are Encrypted by CryptoLocker? Guide to Remove CryptoLocker Ransom Virus

Your files are encrypted by CryptoLocker? Do you know what is it? What can you do to remove it and protect your files and computer system? Let’s read this passage and learn some basic knowledge of CryptoLocker. 

What Is CryptoLocker?

CryptoLocker is a ransom virus which is able to lock users’ personal files including documents, photos and videos saved in the infected computer. It states that users need to pay 100 USD or 100 EUR to obtain a private key in order to decrypt those files. It also scares users that any attempt to remove or damage CryptoLocker will lead to immediate destruction of the private key by server. Yes, we have got a way to decrypt those files; however, pay the ransom will not help you to get back your files, because it is a ransom virus, it aims to ransom users’ money, but not decrypt your files. If you have backed up your personal files, you are a lucky man. Or, your files will be lost forever. On another hand, users have to remove CryptoLocker ransom virus as soon as possible, because it will lock more of your files if you leave it in your computer.

Screen Shot of CryptoLocker

What CryptoLocker Ransom Virus Will Do to My Computer?

1. CryptoLocker enters your computer sneakily;

2. CryptoLocker is able to lock all personal files saved in the infected computer;

3. CryptoLocker aims to ransom users’ money;

4. CryptoLocker alerts startup items of the infected computer in order to be launched automatically when users boot their computers;

5. CryptoLocker creates malicious files and registry entries to the compromised computers;

How Does CryptoLocker Come to My Computer?

CryptoLocker is bundled with free games or programs on the Internet in most of the times. When users download those games and programs, it is downloaded together. It drops malicious files and registry entries to the infected computer once installed. It alerts the startup items so that it can be activated at each computer boot-up. CryptoLocker hides deeply behind the system and runs at the background.

Guide to Remove / Get Rid of CryptoLocker Ransom Virus 

Solution one: get rid of CryptoLocker ransom virus manually from the infected computer.

Before performing the manual removal of CryptoLocker, reboot your computer and before Windows interface loads, press F8 key constantly. Choose "Safe Mode with Networking” option, and then press Enter key. System will load files and then get to the desktop in needed option.

1. Close all running processes.
Before you end its relevant malicious processes shown as below, please make certain you have saved and close all the running files or any other applications first.

2. Disable any suspicious startup items that are made by infections.

For Windows Xp: Click Start menu -> click Run -> type: msconfig in the Run box -> click Ok to open the System Configuration Utility -> Disable all possible startup items generated.

For Windows Vista or Windows7: click start menu->type msconfig in the search bar -> open System Configuration Utility -> Disable all possible startup items generated.

3. Delete virus files
The related files can be looked for through the Internet; you just then search for these files on your pc and delete them manually.

%AppData%\random.exe
%LocalAppData%\random.dat
%LocalAppData%\random.exe

4. Remove malicious registry entries
CryptoLocker adds corrupt entries in the compromised computer's registry so it can hide deeply without you knowing. Again search for and delete the related registry entries listed below (Press Win+R to launch the Run window, then type “regedit” to the search bar, and click OK):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "" = "%LocalAppData%\\random.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[RANDOM CHARACTERS].exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Random
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” =Random
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\Random.exe

Video on How to Remove CryptoLocker Ransom Virus

Solution two: automatically stop CryptoLocker ransom virus with SpyHunter.


Step one: download SpyHunter on the computer by clicking on the icon below.

Step two: install SpyHunter on your computer step by step.

Step three: after the installation, do a full scanning to find out those malicious files related to CryptoLocker ransom virus.

Step four: restart the computer, and then run a full scanning again to check whether all unfamiliar files have been deleted.


Important Notes: Manual removal is too intricate to handle. Moreover, it is very easy to make mistakes to lead to further damage to the computer. Thus, if you don’t have enough knowledge about computer operation, you’d better not take risk taking manual method to remove CryptoLocker ransom virus. However, automatic removal with SpyHunter is easier than manual removal. Meanwhile, SpyHunter is able to take preventive measures to safeguard the computer daily. So we strongly recommend SpyHunter to you.