How to remove HarpoonLocker Ransomware and decrypt .locked files

What is HarpoonLocker Ransomware

HarpoonLocker is the name of a recent ransomware infection reported by users on malware forums. The virus runs encryption of data with AES-256 and RSA-1024 algorithms making all restricted data cryptographically secure. As a result of this configuration change, users will be no longer able to access their own data stored on infected devices. HarpoonLocker assigns the .locked extension, which is commonly used by many other ransomware infections. This makes it more generic and sometimes hard to differ from other infections like this. It also creates a text note (restore-files.txt) containing ransom instructions.

Developers say all data has been encrypted and leaked to their servers. The only way to revert this and get files back safely is to agree on paying the ransom. Victims are instructed to download the qTOX messenger and contact extortionists there. There is also an option to try decryption of 3 blocked files for free. This is a guarantee given by cybercriminals to prove they can be trusted. Unfortunately, there are no other contacts apart from qTOX that victims could use to get into a discussion with cybercriminals. Many cyber researchers joked that HarpoonLocker should also be called Unnamed qTOX Ransomware since there is nobody victims can talk to. For this and many other reasons, it is highly advised against meeting the listed requirements and paying the ransom. Quite often cybercriminals fool their victims and do not send any decryption tools even after receiving the money. Despite this, purchasing private software from the developers might be the only way to decrypt all the blocked data. Otherwise, no third-party tools are currently able to do this due to secure cryptographic protection. Recovering files via backup copies might be the only and best solution you can find to avoid paying the ransom. We do not exclude a chance that third-party decryptors will be updated and able to decipher HarpoonLocker files in the future. If you do not have any backup copies to use, save the encrypted files and track news regarding this ransomware infection and third-party decryption on this forum. You can also try some decryption tools from our guide – maybe they are already able to provide successful decryption.

How HarpoonLocker Ransomware infected your computer

Infections like HarpoonLocker can use both intricate and simple ways of sneaking into a system. E-mail spam letters, trojans, unprotected RDP configuration, fake updates or software installers (from torrent websites), backdoors, keyloggers, malicious ads, web-injects, and others – are all distribution channels circulating around the web. Many users get unexpected infections after interacting with malicious attachments hidden inside e-mail letters. Such messages are usually sent from legitimate-looking sources like DHL, DPD, FedEx, and other familiar names. Despite they are fake, some users still trust them and act upon their requests. As a result, opening files like Word, Excel, PDF, EXE, or Javascript disguised as “Invoices”, “Shipments”, “Urgent”, “Important”, and other click-bait names like “Government Fines” will lead to malware infection. Cybercriminals change these files to store executable scripts and install malicious infections. To protect yourself against these tricks in the future, it is advised to maintain awareness while reading such letters. Do not be naive and trust whatever you see around the web. Suspiciously-looking content is more likely to tug you into downloading a virus or spyware to surveil the system. For more information about protection, you can read our guide below. There is plenty of useful tips and recommendations to establish secure protection.

1. Download HarpoonLocker Ransomware Removal Tool
2. Get decryption tool for .locked files
3. Recover encrypted files with Stellar Data Recovery Professional
4. Restore encrypted files with Windows Previous Versions
5. Restore files with Shadow Explorer
6. How to protect from threats like HarpoonLocker Ransomware

HarpoonLocker Ransomware files:


README.txt
{randomname}.exe


HarpoonLocker Ransomware registry keys:

no information

How to decrypt and restore .locked files

Use automated decryptors

Download Kaspersky RakhniDecryptor

Use following tool from Kaspersky called Rakhni Decryptor, that can decrypt .locked files. Download it here:

Download RakhniDecryptor

There is no purpose to pay the ransom because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

Dr.Web Rescue Pack

Famous antivirus vendor Dr. Web provides free decryption service for the owners of its products: Dr.Web Security Space or Dr.Web Enterprise Security Suite. Other users can ask for help in the decryption of .locked files by uploading samples to Dr. Web Ransomware Decryption Service. Analyzing files will be performed free of charge and if files are decryptable, all you need to do is purchase a 2-year license of Dr.Web Security Space worth $120 or less. Otherwise, you don’t have to pay.

If you are infected with HarpoonLocker Ransomware and removed from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:

Use Stellar Data Recovery Professional to restore .locked files

1. Download Stellar Data Recovery Professional.
2. Click Recover Data button.
3. Select type of files you want to restore and click Next button.
4. Choose location where you would like to restore files from and click Scan button.
5. Preview found files, choose ones you will restore and click Recover.

Download Stellar Data Recovery Professional

Using Windows Previous Versions option:

1. Right-click on infected file and choose Properties.
2. Select Previous Versions tab.
3. Choose particular version of the file and click Copy.
4. To restore the selected file and replace the existing one, click on the Restore button.
5. In case there is no items in the list choose alternative method.

Using Shadow Explorer:

1. Download Shadow Explorer program.
2. Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
3. Select the drive and date that you want to restore from.
4. Right-click on a folder name and select Export.
5. In case there are no other dates in the list, choose alternative method.

If you are using Dropbox:

1. Login to the DropBox website and go to the folder that contains encrypted files.
2. Right-click on the encrypted file and select Previous Versions.
3. Select the version of the file you wish to restore and click on the Restore button.

How to protect computer from viruses, like HarpoonLocker Ransomware, in future

1. Get special anti-ransomware software

Use ZoneAlarm Anti-Ransomware

Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.

Download ZoneAlarm Anti-Ransomware

2. Back up your files

As an additional way to save your files, we recommend online backup. Local storage, such as hard drives, SSDs, flash drives, or remote network storage can be instantly infected by the virus once plugged in or connected to. HarpoonLocker Ransomware uses some techniques to exploit this. One of the best services and programs for easy automatic online backup is iDrive. It has the most profitable terms and a simple interface. You can read more about iDrive cloud backup and storage here.

3. Do not open spam e-mails and protect your mailbox

Malicious attachments to spam or phishing e-mails are the most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications and provides a very high level of anti-spam protection.

Download MailWasher Pro