ESET Win32/Virlock Cleaner

The VirLock infection falls in the ransomware category, somewhat special because it deploys two separate instances of itself, one taking care of locking the computer's screen, and the other handling file encryption. Thus, it can cause serious data loss and block access to a computer. The ESET Win32/Virlock Cleaner is a malware removal tool that can detect traces of the Virlock ransomware and try to remove them.

VirLock creates various files in the user's profile folders and modifies the system's registry to allow itself to launch at system start automatically. Late variants also run a VirLock service.

To minimize spreading time, it looks for files to infect on local, removable and network drives, transforming them into encrypted EXE files. The ransomware asks the user to pay a sum of money in bitcoins to unlock encrypted files or allow access to the computer.

Suggestively named ESET Win32/Virlock Cleaner, this dedicated removal tool promises to detect whether your computer is infected by the Virlock malware and remove its traces, so as to keep your data secure. In other words, it is a post-infection treatment for the Virlock infection that attempts to safely recover compromised content.

The application runs in the command console, starting to scan the host computer as soon as it is launched. There are a few folders it analyzes first, attempting to find clues that might betray the presence of Virlock.

If no threat is found, a message is shown, and the application closes. On the other hand, if a potentially dangerous file or process is detected, the ESET Win32/Virlock Cleaner prompts you to decide whether to remove it or not.

ESET advises its users to run the ESET Win32/Virlock Cleaner in safe mode only. Please note that the application might detect harmless processes as malicious as well. It is highly recommended you don't remove the file before getting information about the process itself and whether it is legit or not. Otherwise, you might generate a computer failure. For instance, during our tests, the application detected Winlogon.exe (a process which belongs to the Windows login manager) as malicious.