Babuk Locker

Babuk Locker

Babuk Locker is a ransomware cryptovirus that targets digital data and encrypts it with a sophisticated algorithm. Babuk Locker can restrict access to a substantial portion of your files and keep them unavailable until you pay a ransom for them.

Babuk Locker

The Babuk Locker Ransomware ransom note

This ransomware typically leaves a ransom note in every folder where there are encrypted files and contains instructions that explain how to send the hackers the required ransom amount. Threats like Babuk Locker, .Qlkm or .Igal are easily the worst type of malware that you may encounter because the advanced encryption they use and apply to different types of digital information on their victims’ machines is very hard to be removed. Oftentimes, valuable audio and video files, work-related documents, databases and even OS files can become inaccessible for an indefinite period of time unless the victim has backup copies of them.

To regain access, the victims are prompted to pay a certain amount of money to the hackers behind the infection. In exchange for the payment, the hackers are supposed to send a decryption key that should reverse the applied encryption. Unfortunately, there are cases where, once the victims have transferred the money, they never hear from the hackers again and do not receive the promised decryption key or a working solution which will help them regain access to their encrypted information. Therefore, fulfilling the ransom demands always comes with the risk of losing your money in vain, without a guarantee for the recovery of your files and is not an advisable course of action. A recommended alternative is to check online for other solutions and concentrate on how to remove the ransomware and have a clean computer rather than sending money to online crooks.

The Babuk Locker Ransomware

The Babuk Locker ransomware is a virus infection that prevents users from accessing the information stored on their computers. Firstly, the Babuk Locker virus places encrypting code on the victim’s files and then demands a ransom in order to remove it.

For all the users struggling with Babuk Locker, there is a special removal guide below that includes measures that will help you to potentially deal with this malware and remove its traces from your computer. Aside from the removal steps, we have included a file-recovery section where we suggest alternative methods that may help the Babuk Locker victims to recover some of their data. Of course, the best solution is to clean the computer from the ransomware and use your personal file backup copies to recover the data you need, but if you don’t have backups, every file-recovery option that doesn’t involve paying a ransom to online crooks is worthy of your attention.

The Babuk Locker file extension

The Babuk Locker file extension is a special sequence of symbols and digits that gets applied at the end of the names of the files that get encrypted. The Babuk Locker file extension format is unique and cannot be recognized by the OS or any of the software installed on it, thus, no program can read it.

Babuk Locker

The Babuk Locker ransomware will use a hardcoded extension and append it to each encrypted file

While staying on the computer, Babuk Locker can encrypt any new data that gets created or recovered. That’s why users who don’t want to give their money to the cyber criminals behind the ransomware have to first find out how to remove the traces of the infection from their computer in order to give a try to some alternative file-recovery methods.


Name Babuk Locker
Type Ransomware
Danger Level High (Ransomware is by far the worst threat you can encounter)
Symptoms Very few and unnoticeable ones before the ransom notification comes up.
Distribution Method From fake ads and fake system requests to spam emails and contagious web pages.
Data Recovery Tool Not Available
Detection Tool

anti-malware offerOFFER *Read more details in the first ad on this page, EULA, Privacy Policy, and full terms for Free Remover.

Babuk Locker Ransomware Removal


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous.


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    After you open their folder, end the processes that are infected, then delete their folders.

    Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections.


    Hold the Start Key and R copy + paste the following and click OK:

    notepad %windir%/system32/Drivers/etc/hosts

    A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

    hosts_opt (1)

    If there are suspicious IPs below “Localhost” – write to us in the comments.

    Type msconfig in the search field and hit enter. A window will pop-up:


    Go in Startup —> Uncheck entries that have “Unknown” as Manufacturer.

    • Please note that ransomware may even include a fake Manufacturer name to its process. Make sure you check out every process here is legitimate.


    To remove parasite on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

    If you want to avoid the risk, we recommend downloading SpyHunter
    a professional malware removal tool.

    More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

    Type Regedit in the windows search field and press Enter. Once inside, press CTRL and F together and type the virus’s Name.

    Search for the ransomware in your registries and delete the entries. Be extremely careful – you can damage your system if you delete entries not related to the ransomware.

    Type each of the following in the Windows Search Field:

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    Delete everything in Temp. The rest just check out for anything recently added. Remember to leave us a comment if you run into any trouble!


    How to Decrypt Babuk Locker files

    We have a comprehensive (and daily updated) guide on how to decrypt your files. Check it out here.

    If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!


    About the author


    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1