LOCKY File

Files with the .LOCKY extension contain encrypted data of various kinds, without the owner's knowledge, which have been infected by the Locky virus. These could be, for instance, graphic files, documents, or databases. They are encrypted using the strong RSA algorithm and AES-128 ciphers. The attack introducing the Locky Trojan horse is based on fake email messages with an attachment and a malicious macro in the document.

When do .LOCKY files appear?

To make a ransomware malware attack possible, encrypting part of the files on a computer, a specific social engineering must work. Hackers often persuade the user to open an attachment and run the macro through fake messages. .LOCKY files will appear on the computer:

• as a result of renaming and encrypting existing files,
• immediately after unwittingly agreeing to launch malicious software,
• the virus also generates information about the data being taken over and the demand for a ransom.

Typically, there is no way to counteract the encryption if good antivirus software is not installed on the computer.

How to recover the original files?

Ransom demands generated by hackers are automatic, usually involving large amounts in bitcoins. There is no certainty that after paying them, it will be possible to recover files transformed into .LOCKY. A proven method is the system recovery procedure - restoring from backups. However, if current backups are not created in the system, there might be no possibility of recovering the files changed by the LOCKY virus.