West Yorkshire Police your computer is locked file repair fix

Written by Steve.Maz on. Posted in Fixes Tweaks

Need it fixing now ?

We can fix this right now for you  for £45 just boot your computer into safemode with networking support  and give us a call on 0161 291 1044. 

About the infection

Today we came across a new variation of the Metropolitan Police virus posing as West Yorkshire Police claiming to lock your computer until you pay a fine for looking at suspicious pornographic websites. This is otherwise known as ransomware and is completely bogus.

How do I remove the ‘Computer is Locked’ infection?

Either call our tech guys on 0161 291 1044 and have an engineer fix it remotely, or look for one of the many spyware removal tools out. You will need to have the laptop/PC in safe mode with networking for us to assist. This can be done in 3 easy steps stated here. 

Be warned: If you manage to remove it, you will be left with a hard drive full of locked files, please read on to find out how to repair them.

I’ve removed the infection but my files are still locked

The files are actually locked as such, the infection renames your files using the following method and alters the header properties so it cant be read.

“locked-<original_name>.<4 random characters>”

example a picture called sarah.jpg could now be called locked-sarah.jpg.ywmy

Some of the files i’ve found have the following extensions YWMY,TJOO,XJQF,NXDQ,ZRZS,BBIH.

Unfortunately simply renaming the file won’t help as it stores information in the header of the file making it unreadable. It mostly only effects your Music, Pictures, Documents and Videos.

 

How to repairs your damaged files

Well after much messing around trying to write our own script to repair these files it turns out Kaspersky have already made a Decryptor which automatically scans your hardrive for the damaged files and recreating the files without the damaged header. It takes on average 1-3 hours to complete the scan depending on the speed of your computer and amount of data you have.

Download the Repair Tool here

Source: http://support.kaspersky.com/faq/?qid=208286527

please note this is a tool developed by Kaspersky and we will not be hand responsible for any loss of data, we are purely providing you with the information that helped us repair the West Yorkshire Police ‘Your Computer is Locked’ infection.

Before you go, how to clean up the mess

New update: a quicker way of doing what follows is to click on change parameters as shown on the image above and you can tick a box to automatically remove locked files after its been repaired.

Well after actioning the above you should now find you have your files back but still mixed up with the LOCKED-FILENAME.EXT Files, a quick way to clean up the mess is to do the following for each of the following libraries (Pictures, Documents, Music, Videos)

Don’t forget to leave a comment below if you found this support page useful.

Go into your My Documents folder using your Windows Explorer and in the top right you will see ‘Search Documents’, type in “locked-” and let it search through your docs. After its finished you can select all (CTRL+A) and either delete them or move them to a new folder for deletion later. Do the same with all your Libraries as mentioned above and you should only be left with the files you originally had.

If you have any questions feel free to ask or if you found our information useful please be nice enough to acknowledge it our comments section below.

 

Trackback from your site.

Comments (54)

  • Julia Finnis

    |

    Thank you, thank you, thank you!!! I had lost everything due to this virus. I’d asked the computer technician at work and a friend who also works with computers, but they told me there was no hope for my locked document. After lots of tears at my lost University dissertation (that I stupidly had not backed up!!!) I tried one last ditch attempt on Google this afternoon to see if anyone anywhere could help me. When I came across your advice I really didn’t have much faith in it and just downloaded the software as I had no other options left and nothing to lose. I actually still cannot believe I have everything back again, hours of work has been saved! I cannot thank you enough and wish there was some way to show how appreciative I am. You have restored my faith in humanity and I feel a little more at ease with the Internet once more. It all sounds a little dramatic, but the prospect of losing 1000s of words and hours worth of work was devastating. Thank you once more! Keep up the good work against those who clearly have nothing better to do then try scamming others!

    Reply

  • PAUL LEWIS

    |

    worked a treat, thanks very much. wish i had used your fix first!

    Reply

  • Steve

    |

    Worked a treat Thank you, my friends daughter extatic to have files back, thanks again, keep up the good work

    Reply

  • pav

    |

    the software is not working for me. a message which says “original copy of at least one of the encrypted files larger than 4096 bytes is required for successfull decryption. you need to specify path to this file and to encrypted copy after pressing the button continue” what does this mean?

    Reply

    • Steve.Maz

      |

      in some cases the removal tool can’t understand the infected header, what you need to do in this case is find an existing file such as a picture stored on a memory card or something, it requests you firstly find the original file ie stevemaz.jpg from your camera and then the corrupt file locked-stevemaz.jpg.ocde

      Once you have done this with 1 file it will decrypt the rest. If you don’t have an existing file you can use then you are at danger of losing your files :(

      Reply

      • Chris

        |

        I used a sample picture from another PC with the same operating system and copied it onto a USB and the tool started working absolutely fine.

        Thank you Steve Maz for this solution.

        Reply

      • Danny

        |

        Hi Steve, would you by any chance know how i could unlock all my files on my external hard drive where i keep all my back up files, the program fixed all the files on my drive C. but i dont know how to run it to fix the external, any ideas please? Many Thanks.

        Reply

        • Steve.Maz

          |

          Download the decryptor and before clicking start scan, click on Change Parameters, it will allow you to select removable drives. Be sure to attach it before running the program. Hope that helps.

          Reply

  • Helena

    |

    Thankyou so much for this!! I wasn’t sure if it would work and worried it may cause more problems or even be a virus but it worked :D! It was fast and easy and saved all of my files, thankyou so so much!

    Reply

  • Sagra

    |

    Tx so much for the information!

    Reply

  • tracy

    |

    Like all the above, it worked for me too! Just deleting locked files now – taking almost as long as the scan, though that was only 36 mins for me. Thank goodness for people like you to help out with these viruses. My nightmare scenario has now faded to just a headache, and I can take a pill for that. All files rescued, just before we go away on holiday. Spent last 12 hours dreading returning to a computer where nothing works properly – you’ve rescued my holiday … my life, in fact. Thank you!

    Reply

  • Christian

    |

    I believe I managed to get the virus off of my main pc, however i think it did something to my major programs like: it wont recognise internet security center, automatic updater, audio service I keep getting a ”The specified service does not exist” I cant even get the pc to recognise the usb with the decryptor program on it what do i do?

    Reply

  • Tom

    |

    I can’t get rid of the message at the start. Help ? :(

    Reply

  • Hernan

    |

    Hi there, I need help!

    I just the virus lock my pc I have look this up how to remove but nothing seen to be working!
    I try ksskiller found three things re-started but my laptop still lock.

    Please help :(

    Reply

    • Steve.Maz

      |

      Call our shop on 0161 291 1044 to see if we can assist (back open weds)

      Reply

  • jumpy

    |

    Thanks very very very for the information this is really helpful or i could do nothing about this anymore. :D
    Now my machine is decrypting and seems to be running smoothly with it.

    But before that, when I received the ukash warning thing I panic too much and I went straight to system recovery with safe mode, it successfully recover to the way point, but leaving every thing locked.
    I read the other cases online and seems they have a more legit way to deal with it by re-writing “regedit”….i tried to do the same thing but i cant see any <>.exe as they described. does it mean im safe from that virus now ?

    p.s. im now scanning the machine with avast! but seems it doesnt spot anything wrong so far. …and thanks for reading, u r amazing ! :D

    Reply

    • jumpy

      |

      i meant {random number}.exe :)

      Reply

    • Danny

      |

      sounds like you done exactly the same thing as me, lol i also downloaded some free malware programs and scanned the whole pc, when i used microsoft secrity essentials, that seem to find the virus and removed it coz even after the system restore it was still on my pc but not triggered off, i got it from using bitcommet, bad move these days using p2p sharing sites, all attackers use them now. fingers crossed it dont come back! lol

      Reply

      • Steve.Maz

        |

        The program only runs on the c drive I think (I know) have you tried copying some of the files to the c drive and running the decryptor ?

        Reply

        • jumpy

          |

          it fixed both my C and D drive… but some files are just un-decrypt-able….maybe they are too old or rare for the program to refer? haha

          Reply

          • Steve.Maz

            |

            You could be right, I’ve not really had any files of importance that haven’t been repairable, maybe Kaspersky might release updates in the future that may include current decryption, I would suggest trying the tool again in say a month or so.

            Reply

        • Danny

          |

          Hi Again, yes i was going to try and copy all the files across then run again, but for some reason my external drive vanished from my computer, it came back when i restarted the pc, but this time it had FAT 32 underneath the symbol for drive E,and it wouldnt open when i clicked on it, all i did was copy the decryptor exe onto the external drive to try and run it, i did all this before you said to download onto it, and i dont want to risk connecting the drive to my laptop to try and copy my files.i would be very grateful of any ideas you have to help me fix it thanks steve ;o)
          I did notice that even all the files that came with the external drive like driver files that i left on the main page when you open the drive all said locked aswell, so i dont know if that would be the problem maybe pc not being able to read it.

          Reply

          • Steve.Maz

            |

            Sounds like your drive caddie may have blown, you need to take it to a PC shop or send it to us. If you need to speak to us then give us a call on 0161 291 1044

            Reply

        • Danny

          |

          oh i forgot to mention the ex drive doesnt show up at all now, so im stumped, its a WD and i can hear the noise when i plug it in, but nothing shows up. not even the symbol of FAT 32, lol

          Reply

  • Scotty

    |

    How would I remove the West Yorkshire Police Virus on my Sony Vaio??? I do not have the recovery discs anymore and when I turn on the laptop and logon… my computer is instantly locked on that stupid screen???

    Please assist and I would be forever grateful.

    Reply

    • Danny

      |

      Try doing a system restore when you log onto safe mode, then run a virus scan. i think you tap F8 as it starts for safe mode. hope it works for you. my problem now is all my files on my external drive are locked, cant seem to run the decryptor program on that drive.

      Reply

  • Danny

    |

    YOU ARE THE MAN OF MEN!. thanks steve, you have been a great help to me, and its a free service!! what can i say, but thanks so much bud, got my files back. ;o)

    Reply

  • Danny

    |

    just noticed that it has also locked my favourites in internet explorer, is there a way i could fix that aswell please? thanks. ;o)

    Reply

  • jumpy

    |

    I ran the program couple times now i got 99.9% of my stuffs recovered…but sill alot of them under “C:\Users\AppData\Local\Microsoft\Media Player\HME\Albums” remains locked…..i dont find them bothering so i just leave them like that ha…

    and yea I scan my machine with avast again it found the {random number}.exe under some random location….I delete it and now i think im perfectly fine.

    again, thanks very much for the info. :D

    Reply

  • Tarun Nayak

    |

    It worked for me. I have verified my files and it is now restored successfully.

    Thanks Steve for this great service.

    Reply

  • Daniel Stevens

    |

    Wow – I do not want to speak too soon but this is actually working! I cannot believe it – the most important files I needed for work are already back!!! Amazing, Thank you so much!

    Reply

  • Adam Gerrard

    |

    Thank you so much for this!! Your a life saver – I did a full restore of my back up tape today thinking i was going to have to mess around in the morning… but no i have just left this running and gone home! Thanks Kaspersky and Steve – You legend.

    Reply

  • Noah Amoo

    |

    I nearly forgot coming back to say thank you but thank God I did not. Steve, you’ve really helped me. God bless you! My computer restarted after every minute it was turned on so I run the system restore and scanned it online with Bitdefender free scan which removed that dreadful trojan from my computer. Then I got some registry cleaner to help speed up my system. And wonderfully, I just saw your amazing site yesterday which has now helped me get all my project files back! Thank you so so very much. I am grateful.

    Reply

  • tester

    |

    worked.. thankyu

    Reply

  • Deenna

    |

    Hello my computer had this virus but I got rid of the virus and used your Kaspersky RannohDecryptor and it scanned through all my locked files, but they are all still locked how could I fix the problem ?

    Reply

    • Steve.Maz

      |

      Are you sure the locked files aren’t duplicates ? See if the original files are there as well as the locked files. Did the report show any files repaired?

      Reply

  • daniel

    |

    I have been struck by this nasty virus, if i DO NOT have any original copy of the files that have been messed up, am I going to have to lose every single one??

    Reply

  • daniel

    |

    Hey doesnt matter , if you dont have a original copy of a locked file that you want to decrypt.. what does every OS come with.. sample music/pictures. I got a good copy of the blue hills.jpg image of another xp machine, and use that against the encrypted version of same file on the infected machine. Wella, off the program went decrypting all my stuff! :)

    Reply

    • Steve.Maz

      |

      I was just going to suggest that :)

      Reply

  • DEJAH QUICK

    |

    I THINK IT LOCKED MY VOLUME TOO SO I CANT HEAR ANYTHING

    Reply

  • Sonali

    |

    Hi. So I got the virus on my laptop as I was doing my dissertation and I freaked out as I hadn’t backed up my documents and I feel stupid about it and kicking my self. So I haven’t tried anything yet and going to get ity checked tomorrow to see what can be done, but yea I would really love to get back all my documents otherwise I have a busy two months and pulling all nighters to re start on my dissertation. So if anyone has retrieved their files again after they were locked, please let me know that the instructions will work. Thank you

    Reply

  • Corey

    |

    Hi, i went into all of my files in regedit, and only found one thing to remove, i did so, and went into all of my windows files etc. and there was nothing, and when ive restarted my computer its working again, i dont understand? did i remove the virus?

    Reply

  • lina

    |

    can not enter my computer at all . it blocked any entry in to my computer – show same message on full screen . kids have played games last night online and some were catched this bug

    Reply

  • Mark

    |

    Hi – I have been victim of the dreaded ukash scam. I have scanned my computer with most malware programs & they all report clear – my problem is that whilst the virus/malware has gone, it’s left ALL my files locked so I can’t open anything – music. pictures, spreadsheets, etc…etc… it even managed to lock everything on my back up USB drive. Fortunately I do have a network back up which it hasn’t affected – but its the time & trouble to re-build your computer thats the problem. I saw this webpage & thought the Kapersky RannohDecryptor could well be the answer – but like others here I can’t get it to run – keeps telling me that the encrypted file & the original non encrypted files are not the same size. I even tried what Daniel suggested above (great idea by the way !!) & use the Sample Images from windows – but again – it reports they are not the same size & the scan won’t run. Anyone had this issue & got this to work or have any ideas. Many thanks in advance.

    Reply

    • Steve.Maz

      |

      Hi Mark,

      Sorry to hear that, one of my friends got this infection too by search for an image on Google Image search, just shows you how easier you can get the infection. I’ve not had an instance where I’ve not been able to run the scanner, I’ve always been able to match a file with one of the “locked” files. Are you able to get one of the files from your backup to try? or try another sample image. I hope you manage to sort it out, please give us some feedback if you do as it helps advise others.

      Reply

      • Mark

        |

        Hi Steve, thanks for reply. I’ve tried it with several files – photos, spreadsheets, word processing files & mpegs – nothing matches when the program tries to run.
        Something else I should have mentioned is that once it happened I headed for my System Restore to wind the clock back & there where no restore points. I know for a fact it created a restore point only last week when I did a windows update – I saw it doing it – but not a single point to restore to. I looked at the Restore settings & it was switched off ?? So something has tampered with those as well.
        I have B T Net Protect Plus (McAfee) running, along with Malwarebytes Pro (paid version with live scanning) – plus I regulary scan with CC Cleaner & Super AntiSpyware – yet this thing got through the lot without any warning at all. It also seems to have modified all my files on a day when I wasn’t using the computer – over the course of 1x hour judging by the file info (modified date & time),
        It also placed a couple of wordpad files on my desktop – 1x of which was instructions (in poor English) on how to pay the £100 to get my files back.
        I’ve never come across anything as clever & destructive as this.

        Reply

        • Nick

          |

          Sadly it would appear my PC has also been infected by the same strain of this virus. All the “encrypted” files are a KB or 2 larger that the originals, so the Kaspersky RannohDecryptor won’t run. All bright ideas warmly welcomed!

          Reply

          • Steve.Maz

            |

            It does appear to be a new strain of the virus. If you could send me a locked file over (i.e. an sample picture file and original if you have it), I’ll see if I can assist. I’ll email you directly.

            Reply

  • Kelly

    |

    Hi I have the same virus on my laptop, the prblem being once I go into safe mode, it asks for my password and the laptop then starts to shut down after entering password. It goes back to the normal password page and then the virus screen comes back up. Any ideas on what I can do please?
    Thanks

    Reply

    • Steve.Maz

      |

      Hi Kelly,

      If you can’t get into safe mode then its more than likely you will need to remove the harddrive and use a second computer to remove some of the infected files. We could help but we would need physically need your device in front of us I’m afraid.

      Reply

Leave a comment