Recently, computers have become infected with the so-called ransomware virus (Trojan.Winlock), to unlock which you are offered to send a paid SMS. In this article you will learn how you can get rid of this virus absolutely free. In situations where antivirus sites do not open, download and run this utility.
1 way. For the case when Windows boots and a banner appears on the screen.
The easiest way to get rid of a virus on your desktop is to go to the website of the antivirus developer software Kaspersky Lab and use the form to obtain an unlock key. A similar operation can be performed by going to the Doctor Web website. After the banner disappears from your desktop, be sure to scan your computer for viruses.
Sequencing:- Go to the Kaspersky Lab website or Doctor Web. and use the unlock key.
2 and the following methods, for cases when the UNLOCK KEY IS NOT SUITABLE.
If, when you turn on your computer, a banner appears on the desktop, use a free utility to treat CureIt viruses- Download, or the Kaspersky Virus Removal Tool Download These healing utilities can be run even if you already have another antivirus installed on your computer.
Sequencing:Download and run CureIt utility- Download, or Kaspersky Virus Removal Tool Download
3 way. For the case when Windows does not boot.
If when you turn on the computer, instead of booting operating system an offer appears on the monitor screen to part with a couple of hundred rubles, boot the computer into safe mode. To do this, restart your computer and constantly press the “F8” key on your keyboard. After a few seconds, you will be asked to select an option to boot into Windows. Select "Safe Mode with Boot" network drivers". Next, we get rid of the virus using one of the methods described above.
Sequencing:- Boot into Safe Mode
- Delete using a key from one of the Kaspersky Lab or Doctor Web sites.
- To restart a computer.
- Scan your computer for viruses.
4 way. For the case when Windows does not boot in safe mode.
In a situation where you need to remove a banner from the desktop, and the operating system does not boot in either normal or safe mode, the best option there will be either a second home computer, or a neighbor's computer. If there are any, we do everything as in the “first or second method.” Also, it will not be bad if you have a LiveCD, download LiveCD from Dr.Web, by booting from which you can check your computer for viruses. Almost all antivirus programs With latest updates treat the computer from a banner on the desktop.
Sequencing:- Enter the unlock key using another computer, or by booting from a LiveCD, download LiveCD from Dr.Web, download LiveCD from Kaspersky Lab.
- Scan your computer for viruses.
5 way to remove a banner.
For Windows 7: after pressing the Win + U keys, click on the link “Help with settings” - “Privacy Statement”. Next, go to point 5
- After your computer starts, press the keyboard shortcut button windows icon+U
- Select On-Screen Keyboard and click Launch.
- Click "Help" - "About"
- In the window that appears at the bottom, select “Microsoft Web Site”
- In the address field, write http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
- A file save window will pop up, save to your desktop.
- In the browser, click “File” - “Open” - “Browse” at the top.
- On the left, click "Desktop". At the very bottom “File type” - “All files”
- Find the downloaded program and run it.
- Select Full Scan.
6th way to remove a banner.
If the banner appears before the desktop loads, the screen is locked.
- Press Ctrl+Shift+Esc until the task manager starts blinking.
- Without releasing the Ctrl+Shift+Esc keys, click on the task manager " Cancel task".
- In Task Manager, click " new task" and enter " regedit"
- Go to HKEY_LOCAL_MACHINE /SOFTWARE/MicrosoftWindows NT/CurrentVersion/Winlogon
- Go to the right pane of the Registry Editor and check the two options “ Shell" And " Userinit" The Shell parameter value must be " Explorer.exe". Userinit parameter – " C:\WINDOWS\system32\userinit.exe," (no spaces, always a comma at the end)!
- If the “Shell” and “Userinit” options are ok, find the HKEY_LOCAL_MACHINE /SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options section and expand it. If it contains a subkey explorer.exe, delete it (Click right click mouse => Delete).
- Restart your computer.
- Be sure to check your computer for viruses.
If unsuccessful, repeat this method in safe mode.
If none of the above methods help you, you can contact our company at
On this moment presented online a large number of various services and programs for removing viruses and other malware. In this article I will talk about free program Kaspersky Virus Removal TOOL, with which you can remove unwanted advertising banners.
Download Kaspersky Virus Removal TOOL you can from the official website. You can read more about the terms of use in the user agreement.
Program installation:
Installing the program is quite simple. First you need to select a language. The installation wizard will then appear, accept the terms of the license agreement and click Next. Then you need to select the installation folder, click "Next". After this, the installation process of the program will begin.
Working with the program:
After launch Kaspersky Virus Removal TOOL The main menu of the program will appear on the screen (Fig. 1).
Select objects to scan by checking the appropriate boxes and click on the “Run scan” button. After this, a check of the selected elements will start (Fig. 2).
If infected files are detected during the scanning process, a window will appear (Fig. 3).
In this case, it is first suggested to disinfect the infected file; if treatment is impossible, then Kaspersky Virus Removal TOOL offers to delete the file, and if deletion is impossible, then the program offers to skip this file, and tries to isolate him. It is worth noting that for most infected files, either the disinfection or deletion function is triggered. In order to apply the selected action (“clean” “delete” “skip” for all detected malicious objects of this type check the box next to “Apply to all objects”).
Also under review Kaspersky Virus Removal TOOL can detect malware on your computer. In this case, a window will appear (Fig. 4).
In this case, in case of treatment, you will need to restart your PC.
After completing the computer scan, you can view the report. To do this, in the main program window, click the “Report” button. After this, a window will open with a report on the test performed (Fig. 5).
To view a detailed report, click on the icon next to the words “Automatic check”.
This is the process of working with the program Kaspersky Virus Removal TOOL completed, when finished, the program will offer to remove itself from your PC.
Viruses are spreading nowadays in every possible way and it is already difficult to find a person who, at least once in his life, has not bothered to face such a difficult task as an SMS banner. If this incident happened at work or at home, it causes embarrassment in front of colleagues and inconvenience in front of loved ones. What can be done? How can I get rid of such an annoying virus program on my own?
In one of the previous articles I wrote about how to remove SMS banner using DrWeb Live CD. In this article, we will look at the anti-virus software Kaspersky Rescue Disk, with which you can easily cope with the task yourself and remove the SMS banner yourself. So, let's begin. By the way, watch our video lesson!
We select the language and press “ENTER”, read the license agreement and naturally agree with it by pressing the “1” key.
If all conditions have been met, the independent operating system Kaspersky Rescue Disk continues to load. All you have to do is wait for the system window to appear:
If your computer has an Internet connection, it is advisable to check for updates by going to the “Updates” tab and clicking the “Run updates” button. When the updates are complete, you should return to the “Checking objects” tab.
Where should you select a system check using the following parameters " Boot sectors", "Hidden startup objects", and local disks V in this case"WITH". For more confident scanning, you should select the maximum. After which the system check will begin.
Also, for convenience, the independent OS has a built-in registry editor and WEB site browser where you can get the information you are interested in.
If you have any questions, ask them on my forum and I will definitely answer. You can also order the service computer repair at home with travel around Moscow.
The following trouble can happen to anyone (or has already happened): one “fine” day you turn on the computer and instead of your usual desktop you see on the screen banner, requiring you to top up someone’s balance or send an SMS to a specific number to unblock. It is also reported here that the reason for this very blocking was that you allegedly viewed porn or somehow violated the law.
What this actually means is that your computer is infected with a virus, which completely blocks the workspace. Don’t even think about sending any SMS or adding money to the virus writers account – it won’t help anyway. Moreover, if you follow the advice I offer, getting rid of the ransomware banner is not so difficult.
Teme removing SMS banners from your computer I plan to devote several articles on my blog. But today I would like to talk about one of the simplest and most effective methods. Let's talk about the utility Kaspersky Windows Unlocker, which is part of boot disk. It is intended precisely for those who do not want to go into details: which files are affected as a result of the actions of the ransomware virus; which registry branches are damaged and how to fix it manually. Easier this method, perhaps, only those listed below. But, unfortunately, they are ineffective.
So, a few words about advice found on forums on the Internet, but of little use.
1. Use unlock codes that can be found on the sites: Kaspersky Deblocker, DrWeb, Nod32.
The downside is that in order to find this saving code, you need to have access to the Internet from another computer (or other device). And to be honest, in my practice these codes were used very rarely.
2. Using “System Restore”, roll back to the restore point created before infection.
3. Run a full system scan with antivirus.
Regarding the second and third methods, I want to say the following: viruses found these days, as a rule, block the computer completely. Those. you will not only be able to get to your desktop (to launch the antivirus), but also even to call the “Task Manager” or log in through “Safe Mode”.
And one more method, which obviously cannot be called simple:
4. Remove yours HDD– connect it to another computer – scan it with the antivirus installed on that computer.
In this case, the virus itself may be able to be detected (and even removed). But then you will still have to deal with the consequences of the infection by correcting the values in the damaged registry branches. In addition, carrying a hard drive back and forth, disconnecting and connecting it, is not the best idea.
And now more about the program Kaspersky Windows Unlocker. Kaspersky Lab specialists developed it specifically to combat ransomware viruses. This utility is included in the boot disk.
1. On an uninfected computer you need to download the image of this disk from here.
2. Burn the downloaded image to CD or DVD disc. You can do this using various programs(Nero, Ashampoo BurningStudio). I won’t go into detail on this (I’ll just say that I record images using Alcohol 120%).
3. Now we go to the infected computer, insert our disk into the drive and .
4. After loading, the following window will appear: 
Within ten seconds, press any key on the keyboard.
Next, use the arrow on your keyboard to select the “Russian” language and press Enter.
Accept the terms of the license agreement by clicking “1”.
In the next window, go to the line “Kaspersky Rescue Disk. Graphics mode” and press the Enter key. 
We wait a while until the desktop appears on the screen. If the “Network Settings” window pops up, just close it.
5. Now click the button in the lower left corner of the screen and select “Terminal”. 
In the window that appears, manually enter the command from the keyboard and press Enter. 
As a result, a utility will launch that will disinfect the registry. When this operation is complete, close this window: 
6. Now you must run a full computer scan with the program. Most likely, the program window will already be open on the desktop. If not, then click the button in the left corner again and select Kaspersky Rescue Disk. 
On the “Scan Objects” tab, check the boxes next to the objects that the program should scan, and then click the “Scan Objects” button. 
If viruses are detected, the program will report this and ask what to do with them (treat, quarantine, delete).