How it arrives and what it could do
Nobody has documented how KillBot reaches a PC.
The SensorsTechForum write-up lists the usual routes for this kind of malware: spam with attachments dressed as invoices, bank papers or plane tickets, fake installers, cracks and patches, freeware bundles, and torrents.
Treat these as likely routes, not as proven facts about KillBot. If your PC shows the message, think back to what you opened or installed just before it appeared, and check the Downloads folder and the e-mail attachments you opened.
The same write-up warns of capabilities that the code could use. It could add Run or RunOnce entries in the registry so that it starts with Windows. It could also delete shadow copies with the command vssadmin.exe delete shadows /all /Quiet.
No source confirms that KillBot does either one. Even so, a program that shows a false encryption message can sit beside other malware, so do not assume it is the only thing on the PC.
If your files really are locked, the cause may be a different ransomware family that only looks like KillBot. Check the file names and the note against what is described here before you decide.
