VirLock Ransomware - How to remove

VirLock (Win32) ransomware comes from PE_VIRLOCK ransomware family. VirLock cryptomalware can be labelled as a police virus since it pretends to be a law enforcement agency informing the victim that he/she is soon to face the charges of using pirated software. The hackers employ various logos to be more convincing. They even list the penalties which are supposed to be imposed on the targeted user. Obviously, it is not difficult to come up with a user having some unauthorized software on his/her PC. Thus, we may assume that the tactics of these cyber crooks answers the purpose.

About VirLock Ransomware

VirLock ransomware stands out as a polymorphic virus. This means that it changes its signature every time it infects a new file. These code modifications are carried out so that antivirus programs will not get wind of its presence on the computer’s system. VirLock crypto-ransomware has a multi-layer protection code of XOR and XOR-ROL two-stage encryption. Once this virus lands on your computer, it multiplies itself to perform the encryption tasks and to ensure that they would not be terminated. Then, Virlock crypto-malware scans the computer’s system for files to be encrypted. The file types targeted include:

*.exe, *.doc, *.xls, *.pdf, *.ppt, *.mdb, *.zip, *.rar, *.mp3, *.mpg, *.wma, *.png, *.gif, *.bmp, *.jpg, *.jpeg, *.psd, *.p12, *.cer, *.crt, *.p7b, *.pfx, *.pem

As you can see, they are common document files, image files, audio and video files, archive files, executable and certificate files. The ”.locked” extension is appended to the filename extensions of encrypted files, for example, FILE.pdf becomes File.pdf.locked. Interestingly, VirLock file-encrypting virus does not litter your computer with various file formats of ransom note. The image that replaces your desktop wallpaper is hardly to be called a ransom message. It rather resembles a fake threatening spam e-mail with the logos of law enforcement authorities and the note of conviction. The size of the ransom is 250 GBP which must be payed in bitcoins. We can speculate that the hackers’ location may be Great Britain.

How does VirLock Ransomware Infect Your Computer?

VirLock filecoder can be distributed by another malware’s payload, for instance, the KEYHolder ransomware. It can also be spread via spam e-mails containing infected links and/or attachments with infected files. These can be of any kind. Thus, it is generally recommended not to open these e-mails, their attachments or follow the links they contain. Exploit kits, though not specified, are also blamed for the delivery of VirLock file-encrypting virus.

How to Decrypt Files Encrypted by VirLock Ransomware?

There is no decryptor available at the moment of writing this article. But even if you do not have a backup, you can use Shadow Volume Copies since VirLock crypto ransomware does not delete them. However, if you are so unlucky not to have either of those, you can always apply professional file recovery tools such as the software by Kaspersky Lab, Recuva, R-Studio, PhotoRec, etc. Just make sure to remove VirLock malware and all its additions from the computer’s system. For this reason use automatic malware removal tools – Spyhunter. It is always recommended to exercise automatic tools, but it is highly advisable in the case of VirLock infection as it blocks the access to the Start Menu and the Task Manager. Nevertheless, we provide you with an option of manual removal which can be implemented following the free manual removal instructions rendered below. And, lastly, please make a copy of the infected drive for the upcoming decryptor before the removal of VirLock ransomware and regularly back your data up.

Update of the 27 of January, 2017. Even though it might not seem so, but VirLock has always been around, attempting not to catch too much attention from security experts. Now, a new version of VirLock has been released. It follows similar principles for file encryption: it encodes files and creates an .exe replacements for them (they also carry traces of ransomware). We can joyfully state that it is possible to decrypt encoded data completely for free, but it will require some time and attention to detail. After you receive the ransom note, you should know exactly how to treat it and get away from it. You will notice a section called ‘Transfer ID’ in order to be able to restore your files for free, you have to enter 64 zeros and click ‘Pay Fine’. By entering this combination, you will trick VirLock that you have have surrendered and send a transaction of bitcoins. This was an easy part of the decryption process: now you have to work for your files. There is no automatic removal function that would restore your files in a couple of minutes. You will have to run every .exe file that has been added into your device. This will bring your original file back. This part is going to be time-consuming, but at least you are going to retrieve your files. Once you have done that, you should place your original files in a backup location. Be extremely careful not to copy any .exe files that contain the ransomware. Now, you will have to completely clean your system from files or programs.

How to recover VirLock Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before VirLocker ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of VirLock Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to VirLocker ransomware. You can check other tools here.  

Step 3. Restore VirLock Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually VirLocker ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover VirLock Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.