How to remove PyLock ransomware and decrypt .locked files

PyLock ransomware encryption process

PyLock ransomware is a new type of encryptors, the aim of which is to change the structures of your files. In the most cases this virus is spread by the means of different email attachments and once you open such a malicious attachment, the virus is successfully injected into your system. Then, sooner or later, it proceeds 2 processes: scanning for the appropriate files like documents and media files, and then encrypts them. As the result of these operations, your files are unreadable as the extensions of these files have been changed to .locked ones. Don’t try to remove PyLock ransomware encryption by the renaming of the file, as it won’t help and can possibly damage your files. It’s clear, that the aim of such attacks is your money, that’s why hackers usually left special ransom notes. The form of it is always different and in our case, it’s the form of a window that contains the following message:

The important files on your computer have been encrypted with military grade AES-256 bit encryption. Cannot be unlocked without the decryption key.
* DON'T MODIFY OR RENAME ENCRYPTED FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!
* DON'T MODIFY ENCRYPTED UNIQUE KEY, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!
* DON'T USE THIRD-PARTY OR PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!
To acquire this key, transfer the Bitcoin Fee to the specified wallet address before the time runs out, for instructions: solutionshelp@protonmail.com
If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost.

As you can see the price is too high, moreover, there is a great risk to lose your money, as you don’t have any firm guarantee of them honoring their promises. We strongly recommend you to avoid any contact with the intruders. If you wonder how to remove PyLock ransomware and decrypt .locked files, you may read our detailed guide for free now!

---

Article’s Guide

1. How to remove PyLock Ransomware from your computer
2. How to remove PyLock Ransomware encryption from your files
3. Data Recovery
4. Automated decryption tools
5. Windows Previous Versions

---

How to remove PyLock Ransomware from your computer?

We strongly recommend you to use a powerful anti-malware program that has this threat in its database. It will mitigate the risks of the wrong installation, and will remove PyLock from your computer with all of its leftovers and register files.

Solution for Windows users: our choice is Norton 360 . Norton 360 scans your computer and detects various threats like PyLock, then removes it with all of the related malicious files, folders and registry keys.

Download Norton

If you are Mac user, we advise you to use Combo Cleaner.

---

How to decrypt .locked files?

Once you’ve removed the virus, you are probably thinking how to decrypt .locked files. Let’s take a look at possible ways of decrypting your data.

Recover data with Data Recovery

1. Download and install Data Recovery
2. Select drives and folders with your files, then click Scan.
3. Choose all the files in a folder, then press on Restore button.
4. Manage export location.

Download Stellar Data Recovery

_{The download is an evaluation version for recovering files. To unlock all features and tools, purchase is required ($49.99-299). By clicking the button you agree to EULA and Privacy Policy. Downloading will start automatically.}

---

Restore data with automated decryption tools

Unfortunately, due to the novelty of PyLock ransomware, there are no available automatic decryptors for this encryptor yet. Still, there is no need to invest in the malicious scheme by paying a ransom. You are able to recover files manually.
You can try to use one of these methods in order to restore your encrypted data manually.

Restore data with Windows Previous Versions

This feature is working on Windows Vista (not Home version), Windows 7 and later versions. Windows keeps copies of files and folders which you can use to restore data on your computer. In order to restore data from Windows Backup, take the following steps:

1. Open My Computer and search for the folders you want to restore;
2. Right-click on the folder and choose Restore previous versions option;
3. The option will show you the list of all the previous copies of the folder;
4. Select restore date and the option you need: Open, Copy and Restore.