How to remove Lion ransomware and decrypt .lion files

Article’s Guide

1. What does .lion stand for?
2. Lion ransomware encryption process.
3. How to remove Lion Ransomware from your computer
4. How to decrypt .lion files
5. Data Recovery
6. Automated decryption tools
7. Other software

---

What does .lion stand for?

Lion ransomware is the newest virus the main function of which is to prevent a victim from the accessing to the definite file formats. Nowadays it’s impossible to define the family this virus belongs to, however, its functions are the same with a great number of other file encryption ransomware viruses. As the rule it spreads by the means of GiftCardAmazon.scr file, that can be found here: http://publicsgroupe.net/GiftCardAmazon.scr. We should warn you not to try to execute this file, as it will immediately infect your computer with Lion ransomware. However, the code of the virus can be injected into other files and be spread by the means of common file sharing services and torrent trackers. Moreover, it can be easily be sent by email or even infect a computer remotely by the means of various remote access software. For these reasons we recommend you to get a strong antivirus software, that can prevent a possible attack. If you are unlucky and your computer is already infected with this virus, we must warn you not to try to remove Lion ransomware manually, or to try to decrypt .lion files by the meaning of file modifying. Manual ways can easily damage your data and system without any hope to restore.

---

Lion ransomware encryption process.

Once the GiftCardAmazon.scr file has been executed, Lion ransomware immediately begins to install itself into an operating system. At first it makes some changes in the Registry folder in order to hide itself in the system processes. When it’s done, Lion begins to scan your system and looks for the files, that are appropriate for the encryption. As the rule these files are various formats of media files, documents, archives and databases, however, some of ransomwares can easily encrypt .exe and .dll files. Then Lion ransomware begins to modify file structures and the files get the new extension – .lion. It’s the one of the clearest signs of the infection with this virus. One more characteristic feature is the ransom window. By the means of this window hackers inform victims about the infection, the price of their decryption services and left their contacts. Unfortunaterly, the surest way to decrypt the data is to get the decryptor from them, but we recommend you to avoid any contact with them, as they can easily deceive you. In the most cases, hackers just ignore the victims, once they’ve been paid. However, it’s nothing for them to send them something more malicious, than a ransomware instead of the decryption tool. At the same time there are some ways, that can possibly halp you to remove Lion ransomware and decrypt .lion files!

---

Lion.exe

---

How to remove Lion Ransomware from your computer?

We strongly recommend you to use a powerful anti-malware program that has this threat in its database. It will mitigate the risks of the wrong installation, and will remove Lion from your computer with all of its leftovers and register files.

Solution for Windows users: our choice is Norton 360 . Norton 360 scans your computer and detects various threats like Lion, then removes it with all of the related malicious files, folders and registry keys.

Download Norton

If you are Mac user, we advise you to use Combo Cleaner.

---

How to decrypt .lion files?

Once you’ve removed the virus, you are probably thinking how to decrypt .lion files or at least restore them. Let’s take a look at possible ways of decrypting your data.

Restore .lion files with Data Recovery

1. Download and install Data Recovery
2. Select drives and folders with your files, then click Scan.
3. Choose all the files in a folder, then press on Restore button.
4. Manage export location.

Download Stellar Data Recovery

_{The download is an evaluation version for recovering files. To unlock all features and tools, purchase is required ($49.99-299). By clicking the button you agree to EULA and Privacy Policy. Downloading will start automatically.}

---

Decrypt .lion files with other software

Unfortunately, due to the novelty of Lion ransomware, there are no decryptors that can surely decrypt encrypted files. Still, there is no need to invest in the malicious scheme by paying a ransom. You are able to recover files manually.
You can try to use one of these methods in order to restore your encrypted data manually.

Decrypt .lion files with Emsisoft decryptor

This software includes information about more than 100 viruses of STOP(DJVU) family and others. All that you need are two files or some luck. You can freely use it as it distributes free of charge. If it doesn’t work for you, you can use another method.