Do you know what Mrlocker Ransomware is?
Mrlocker Ransomware is not a typical ransomware infection. Unlike some other ransomware infections detected and analyzed by our specialists, it does not encrypt any files. Instead, it acts as a screenlocker. That is, it opens a blue window in full-screen on Desktop and tells users that they need to enter a code to unlock their PCs. Even though, at the time of writing, users are not provided with the payment instructions and, consequently, it is impossible to purchase the code for unlocking the screen, it is very likely that a new fixed version of Mrlocker Ransomware will demand money in exchange for the unlock code. There is no point in sending money to cyber criminals because the screen can be unlocked by entering the code 6269521. If you ever encounter an updated version of this ransomware infection and this code does not work, boot into Safe Mode and remove the malicious application fully. The screen-locking window will disappear from the screen when the threat is no longer active.
According to our experienced team of specialists, Mrlocker Ransomware has been originally developed for testing purposes because, at the time of writing, it places a screen-locking message on Desktop which does not contain any information about the payment. Users are not told how to purchase the key for unlocking the screen either. Victims are only told that their screens have been locked because of downloading illegal content, which is not true. Locking users’ screens is not the only activity this ransomware infection performs on victims’ computers. Research conducted by our experienced specialists has also revealed that this ransomware infection kills three processes, if it finds them active, as well: taskmgr, cmd, and regedit. Evidently, it tries to make it harder to remove it. Some users believe that they can get rid of this infection by restarting their PCs, but it is not true. Your screen will not be unlocked either if you reboot your PC because this ransomware infection creates a PoE (point of execution) in the Run registry key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Because of this, it can launch together with the computer. To put it differently, it will start working together with the Windows OS, and, consequently, you will find a blue screen-locking window on your Desktop again. The only way to get rid of it once and for all is to remove the ransomware infection fully. Let’s talk about its distribution in the next paragraph, and then we will talk about its removal in detail.
Mrlocker Ransomware screenshot
Scroll down for full removal instructions
Mrlocker Ransomware is not a prevalent infection at the time of writing. As mentioned earlier in this article, it could have been developed for testing purposes primarily, so it is not spread actively, for sure. We do not say that this cannot change one day. If cyber criminals ever start actively distributing Mrlocker Ransomware, they will, most probably, adopt two distribution methods well-known for malware analysts. First, there is basically no doubt that it will be spread via spam emails. Second, it might be promoted as a beneficial application on untrustworthy third-party pages, according to our specialists. You will already know after reading this article how ransomware infections usually enter computers; however, it does not mean that it will be a piece of cake to prevent these threats from entering the system in the future. Therefore, our security specialists highly recommend installing and enabling a security application on the system too.
You will find the manual removal guide that will make it easier to delete Mrlocker Ransomware from the system below this article; however, it is not the only way to erase this threat from the system. You can delete it automatically as well. Of course, you will first need to acquire an automated malware remover from the web.
Delete Mrlocker Ransomware
- Enter the unlock code 6269521 in the unlock box located on the blue window opened by the ransomware infection.
- Tap Win+R after unlocking the screen.
- Enter regedit.exe in the box and click OK.
- Move to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
- Right-click on the Mr Locker Value and select Delete.
- Close the Registry Editor.
- Delete all recently downloaded files from %TEMP%, %USERPROFILE%\Downloads, and %USERPROFILE%\Desktop.
- Empty the Trash bin.
In non-techie terms:
Cyber criminals develop all kinds of ransomware infections every day. In most cases, the motive behind this is getting easy money. Therefore, the chances are high that you will detect a new ransomware infection on your PC again if you keep your system unprotected. We have two pieces of advice for those users who are ready to do what it takes to avoid malware. First, they should enable a reputable security application on their computers. Second, they should stop downloading programs from P2P websites they know nothing about because they might be promoting malware.