Unlock26 Ransomware Removal Guide

Unlock26 Ransomware is a recently found malicious computer infection that can encrypt your personal files and demand that you pay a ransom to get them back. Needless to say, you should remove this ransomware instead because you cannot expect cyber criminals to keep their word. This program is somewhat unique because it is a Ransomware-as-a-Service-type ransomware which means that its developers provide it to other criminals to distribute it and then take a cut of the profits.

The developers of Unlock26 Ransomware have created a ransomware and an accompanying program called Ransomware Builder that they distribute secretly and supply would-be cyber criminals who then use their own imagination and make distribution campaigns set to infect the computers of innocent people. The builder and the core file are featured on a website that is accessible to a select few.

This ransomware is promoted as Ransomware as a Service (RaaS) which means that its developers provide other would-be cyber criminals with a program called Ransomware Builder that allows them to build a custom version of Unlock26 Ransomware. The user can use Ransomware Builder to customize this ransomware in many ways such as enabling partial encryption, and the builder asks whether the user wants to encrypt only the first 4MB of the files. It allows the selection of default encryption price that is universally applied to all regions but also has a feature that allows the user to ask a larger or smaller ransom from a preselected list of countries. So, for example, while it might ask all countries for 0.2 BTC, it can make an exemption for the US and ask people located in this country to pay 0.3 BTC. This feature enables criminals to maximize potential profits by customizing the payment requirement for individual countries by the standard of living.

Furthermore, the user can select or omit certain file extensions from being encrypted but, for example, it can potentially encrypt file extensions such as .dat, .wmv, .pdf, .rar, .mp4, .zip, .txt, and .mkv. However, this ransomware is capable of encrypting hundreds of file formats, but it is the user that selects the particular extension for this ransomware to target. While encrypting the files, this ransomware will append them with either a “.locked-1RU” or “.locked-k7K” file extension, and after that, it will run the “vssadmin delete shadows /all /quiet” command to delete shadow copies of the encrypted files.

Once the encryption process has been completed, this ransomware will generate a ransom note named ReadMe-{random symbols}.html. The name is different in each case, but the note says that you must visit one of four websites where you can pay the ransom and get the cyber criminals to decrypt your files. However, as mentioned, you should not trust them to deliver on their promise.

In closing, Unlock26 Ransomware is a dangerous computer infection that can get onto your computer when you least expect it, and if you do not have an antimalware application, then there is nothing that could stop it. If your PC got infected with it, then you should remove it because you cannot count on the cyber crooks to give you the decryption key. We suggest using SpyHunter to detect the malicious file(s) and then go to their locations and remove them manually.

Manual Removal

1. Go to http://www.411-spyware.com/download-sph
2. Download SpyHunter-Installer.exe and run it.
3. Install and launch the program.
4. Click Scan Computer Now!
5. Copy the file path of the malware from the scan results.
6. Simultaneously hold down Win+E keys.
7. Enter the file path of the malware in File Explorer’s address box.
8. Press Enter.
9. Locate, right-click the malicious file(s) and click Delete.
10. Empty the Recycle Bin.