MBL Block Off – Decrypt Protect Virus

Hi, my computer catches a virus that totally locks the desktop. I cannot access my files or run any program on the PC. I am receiving MBL Block Off, which is from Decrypt Protect. I believed that this is another ransom malware that wants me to pay certain amount in order to unblock the computer. Just as any ransom program, Decrypt Protect virus demands that payment should be made via MoneyPak or Paysafecard.

I noticed that this virus came into my computer after my brother downloaded and installed a security update for Java. It could have been a fake update and instead, installed Decrypt Protect virus on our system.

Restarting Windows in safe mode is not doable. Maybe, the virus has disabled that function. So, there is no way for me to bypass the malware and scan the PC. What other suggestions would you recommend aside from restoring Windows to previous restore point? I will carry on with the system restore later. However, I prefer easy removal first because there have been a lot of changes since I last saved a restore point. I don’t want to lose it.

3 Responses

  1. jj_miller says:

    I believe that staff from Dr. Web can help you decrypt all files affected by Decrypt Protect. However, removal is not instant. They need your file so that they may be able to find the right command to decrypt it. You may follow these steps.

    1. Go to vms.drweb.com/sendvirus/?lng=en
    2. Upload one of the files encrypted by Decrypt Protect virus.
    3. At submission category please type “request for curing”
    4. Fill in your email address so that they can contact you in case of any development.
    5. Write a few words about the status of the file.
    6. Lastly, click SEND button.

    Engineed from Dr. Web will personally respond to your request sending you a link to the last version of the “cure” and comand line instructions. This may take a couple of days.

  2. benny1414 says:

    An anti malware expert named Fabian Wosar has released a tool to decrypt the .html files encrypted by the decrypt protect/mbl advisory virus. Read through the thread at:

    bleepingcomputer.com/forums/t/494759/decrypt-protect-ransomware/page-3

    I had over 2TB of data affected and this tool recovered every byte!

  3. tumbler2020 says:

    How to decrypt files affected by “Decrypt Protect” virus?

    There is a new tool developed by Emsisoft security company called Trojan-Ransom.Win32.MBlBlock Decrypter. This was made especially for files that are infected with Decrypt Protect virus. Here is how you can use the tool.

    1. Download Trojan-Ransom.Win32.MBlBlock Decrypter from the link below and save the file to accessible location on your hard drive.

    http://tmp.emsisoft.com/fw/decrypt_mblblock.exe

    2. When finished downloading, double-click on the file decrypt_mblblock.exe.

    3. The tool will run and scan hard drive for infected files. Found encrypted files will be restored leaving the infected files in your hard drive. Thus, you have to delete the infected files once decrypted files are verified to be functional.