How to remove MBRlock ransomware

MBRlock – new crypto-ransomware that targets Chinese and English-speaking users

MBRlock is file-encrypting ransomware, which locks most of the personal files on a target PC and demands a ransom for a unique decryption code. Since it's oriented to Chinese-speaking users, in particular, the virus name 易 语言 程序 in Chinese can be found even more often. Nevertheless, English version is also available and spreads on the Internet quite actively. Usually, hackers embed the virus on PCs with Microsoft's Remote Desktop Protocol^[1] enabled or distribute spam with malicious attachments. The executable file of the MBRlock virus varies, but the currently used files are MBRLock.exe, runas.exe, and Hax.exe.

When the executable file is enabled, MBRlock ransomware encrypts the following file types: .BMP, .CUR, .GIF, .ICO, .JPG, .MID, .PNG, .prn, .txt, and .WA. Right after that, extortionists enable a black lock screen on the desktop of the hijacked PC and displays a red skull icon with the text written in white. People are informed that “Your disk has a lock !!! Please enter the unlock password.” Currently, the MBRlock ransomware demands its victims to pay 30 CNY ransomware,^[2] which is equal to 4.76 USD.

For some, such a small ransom^[2] may seem to be funny. However, it may be the strategy used by hackers to check the potential of the file-encrypting ransomware. In case of success, criminals may increase the increase the amount of demanded redeem, which is why we do not recommend paying it. For the sake of security, remove MBRlock from your PC as soon as attacks it using one of these tools: FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes. Keep in mind that each ransom, even if it's only 4.76 USD, motivates cyber criminals for further attacks.

Ransomware dissemination methods: spam email, unprotected RDP configuration, fake updates

Ransomware virus developers exploit various techniques to disseminate their “products” to the greatest extent possible. One of the mainly used strategies is spam email with malicious attachments. It's used since the beginning of ransomware “business” and is still the most successful ransomware execution strategy.

Hackers can easily get thousands of email addresses from the black market and set fake email messages to randomly chosen people. The subject of such messages is usually a mix of letters and numbers to resemble the code of a document or something. Some spam contains text, while the others simply enclose a .doc, .jpg, .png, .avi or .pdf file. For opening the attachment, people are usually asked to enable Macros. The virus won't be executed as long as you won't enable Macros and launch the file completely.

In addition to malspam, hackers often exploit unprotected RDP configuration or spread infected stand-alone installers of system files, fake software updates, and similar techniques. Unfortunately, but having an anti-virus program installed cannot ensure full ransomware protection. To keep the system secured, security specialists ask people to think twice before accessing illegal domains^[3] and weighing the risks. 

Safely remove MBRlock ransomware from the system

If MBRlock evaded your antivirus protection and encrypted your files, do not rush to pay the ransom. Although the ransom demanded is not large, don't forget with whom you are dealing. Paying the ransom does not guarantee that hackers will send you a working MBRlock decryptor. Contrary, you may motive extortionists to attack you again in the future.

Since we have already clarified the reason why MBRlock removal is a must, now we should discuss all possible removal options. In general, manual ransomware removal is hardly possible because they consist of multiple files that are scattered in random system's folders. Therefore, the best way to remove MBRlock virus or any other crypto-ransomware is to run a scan with FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes tool.

At the moment of writing, a free MBRlock decryption key is not available. Nevertheless, you can always try to recover lost data by following the methods listed down below this article.