Ransomware note appeared after files renamed to .locked

1. STOP/Djvu ransomware — most common cause of .locked extension

If you see files renamed to .locked and a ransom note named _readme.txt or !!!READ_ME!!!.txt, it's almost certainly STOP/Djvu ransomware. This is the most common ransomware for Windows users in 2023 and 2024. It spreads through cracked software, fake installers, and email attachments.

The ransom note usually says something like: "Don't worry, you can return all your files" and asks for payment in Bitcoin. Ignore that. Most victims can decrypt files for free if the malware used an "offline key."

What needs to happen first — remove the ransomware

1. Disconnect from the internet — pull the ethernet cable or turn off Wi-Fi. This stops the ransomware from talking to its command server.
2. Boot into Safe Mode with Networking — restart your PC and press F8 or Shift + Restart in Windows 10/11. Choose Safe Mode with Networking.
3. Run a full scan with Malwarebytes — download Malwarebytes (free version works fine) from a clean PC and transfer via USB. Run a full system scan. Remove everything it finds. After scanning, run a second scan with AdwCleaner for good measure.
4. Now try to decrypt your files — download Emsisoft's STOP Djvu Decryptor. It's free and safe.

How to use the decryptor

1. Run the decryptor as Administrator.
2. Click Options and set your file extension to .locked.
3. Click Decrypt. The tool will check if your files can be decrypted.
4. If it says "Offline key found" — great! It should recover most files. If it says "Online key needed" — you may be out of luck unless you have a backup.

Real-world example: A client got infected after downloading a "free" Adobe Premiere Pro installer from a torrent site. Files renamed to .locked within 5 minutes. We used the Emsisoft decryptor and got back 95% of files.

2. Phobos ransomware variant (rare but possible)

Some Phobos variants also rename files to .locked. These are tougher. The ransom note will usually have a different name, like info.hta or How_to_back_files.html.

Phobos rarely has a free decryptor. The real fix here is restoring from backup.

Steps for Phobos infections

1. Remove malware first — same process as step 1: Safe Mode, Malwarebytes, AdwCleaner.
2. Check for shadow copies — right-click an affected file, go to Properties > Previous Versions. If any version shows up, restore it. This works maybe 10% of the time with Phobos.
3. Use ShadowExplorer — download it from shadowexplorer.com. It scans for Volume Shadow Copies that Windows hides. You might find clean copies of your files.
4. If nothing works — try Recuva (Piriform) to recover deleted original files. Ransomware sometimes deletes the originals after encrypting them. Recuva can bring them back if you act fast and don't write new data to the drive.

Personal take: I've seen Phobos infections where the decryptor doesn't exist. Don't pay the ransom. It's a gamble and usually fails. Focus on backups next time.

3. Fake ransomware or scareware (not real encryption)

Sometimes the file extension changes but the files aren't actually encrypted. This is a bluff from a weaker malware. It renames files to .locked but doesn't touch the data. The note might look scary but it's fake.

How to tell if it's fake

• Try opening a renamed file (like a .jpg or .docx) by renaming it back to its original extension. If it opens normally, it's fake.
• Check file size — if the size didn't change after encryption, it's likely fake.
• Look at the ransom note grammar — real ransomware notes are usually in broken English. Fake ones often have perfect English or lots of typos that are clearly machine-translated.

Fix for fake ransomware

1. Run Malwarebytes full scan in Safe Mode to remove the malware.
2. Use Bulk Rename Utility to strip the .locked extension from all files at once. Just remove the extra extension and keep the original.
3. Scan all restored files with antivirus before using them.

Quick-reference summary table