What to remove by hand
None of the pages we read names a registry key, scheduled task, service or folder that LOL creates, so we cannot give you an exact list of hidden traces without guessing. We only list what the sources name, and then say where to look yourself.
Traces named by the sources:
– get data.txt
, the ransom note, in every folder that holds encrypted files, and possibly on the desktop
– files ending in .LOL!
, which are your own encrypted documents and not malware; keep them until you have a backup or a decryptor
– the e-mail address [email protected], which is only text in the note and needs no removal
– cryptor.exe and decryptor.exe, mentioned in the note; search the PC for them, and treat any match as suspicious until a scan clears it
To find the program that did the damage, open Settings, Apps, Installed apps and sort by install date. Then open Task Scheduler and look for tasks you did not create. Check Settings, Apps, Startup and the Downloads folder for key generators, cracks or unknown attachments saved shortly before the first .LOL! file appeared.
Delete the notes only after you have saved one copy for identification. Run a full Microsoft Defender scan, then ...