ShinoLocker Ransomware Removal Guide

You may be surprised to learn that ShinoLocker Ransomware is an educational ransomware that was created by a security researcher named Shota Shinogi. This ransomware was presented at Black Hat 2016. Its most important feature is that anyone can use it to create their own custom ransomware. Even though it is used by malware researchers for training and educational purposes, in the wrong hands this software can be used for illicit activities. In this article, we will present you with all of the information that is currently available about this infection.

Due to the nature of this ransomware’s origins, it is not distributed using malicious methods. However, anyone can visit its dedicated website (whose link we will not provide) and build their custom ransomware. The difference between this ransomware simulator and real ransomware is that it does not ask for money for the decryption key, so if you build a ransomware that is based on ShinoLocker Ransomware and encrypt the files on a computer, then you can easily decrypt them. Now let us go over its functionality and features.

Our research has revealed that this ransomware can delete shadow copies, and this option is enabled by default, so if you execute this ransomware on your computer, then they will obviously get removed. Nevertheless, this feature can be removed when building your custom ransomware, so it all depends on what options you select and deselect.

By far the most important thing regarding this ransomware is the coding language in which it is written. Its developer has opted to use the .NET language. Therefore, everyone can access the source code and create a ransomware without the safety switches, one that can demand that you pay a ransom for the decryption key.

Now let us take a look at the processes that take place when you launch this ransomware. When launched, this ransomware makes a copy of itself in the %TEMP% folder with a random string name. Then it opens its GUI (Graphical User Interface.) It has a screen that shows all of the steps that this ransomware performs. You can click STEP1 and receive the decryption key. The decryption key works as expected and your computer should not have lasting effects on it. After encryption the ransomware erases itself.

Take note that while encrypting the files on your computer, this ransomware will append it with the .shino extension and change the icon of the file to that of ShinoLocker Ransomware’s main executable which has green text saying Shino Locker in a black background made to look like a lock. As far as the file types that this ransomware can encrypt go, there is no default setting so the person that builds the ransomware gets to decide which types of files will be targeted and encrypted.

As you can see, this unique ransomware is not a real infection because it is not distributed like one and does not demand payment to decrypt the files. Still, it has one major flaw which is that it was written in .NET. This means that programmers with the right set of skills can get to the source code, modify it and develop ShinoLocker Ransomware into a real ransomware.

As previously stated, this ransomware deletes itself after the decryption of your files, but if, for some reason, its files remain on your PC, then you should remove them just in case. Please follow the instructions featured below to get rid of those files. This ransomware is the perfect example of an infection that can ruin your files beyond repair. We recommend SpyHunter because it can deal with any ransomware-type infection, as it is frequently updated.

How to get rid of this ransomware

1. Remove the executed file.
2. Hold down Windows+E keys.
3. Type %TEMP% in the File Explorer’s address box.
4. Locate the randomly name .exe file with the Shino Locker icon.
5. Right-click it and click Delete.
6. Empty the Recycle Bin.