How to unlock a computer from a banner? This question is asked by a huge number of users who have become victims of ransomware Trojans. A Winlock/MBRLock class virus blocks the operating system by accusing the user of distributing pornographic video content and offering to pay money (top up a specific account or mobile number) in exchange for code times Windows locks . Of course, there is not and cannot be any Windows unlock code on the payment terminal receipt (that’s why it’s a scam). To avoid getting into such a situation, you must use licensed antiviruses from reputable laboratories ( Kaspersky Lab, Dr.Web, Symantec), well, since you are already in trouble, it will help you choose the Windows unlock code based on the account/phone number displayed by the ransomware Trojan.

Below are three online unlocking services: Dr.Web and Kaspersky Lab. Also described is a method for removing a ransomware banner using boot disk with antivirus in case Windows unlock code Couldn't find it.

Dr.Web is a free computer unlocking service.

Online Windows unlock service.

The famous Russian antivirus laboratory Dr.Web offers free online computer unlocking service. The Windows unlock code can be selected either by the account number or by the image of the ransomware banner window.

Windows unlock service provided by Kaspersky Lab

In addition to antivirus products highest quality, the Russian laboratory of Evgeniy Kaspersky provides everyone, absolutely free, with its computer unlocking service"Kaspersky Deblocker". I would like to note that users who use the products of this anti-virus laboratory on their computer are reliably protected from any viruses and do not encounter the problem of infection or blocking of Windows.

Find a Windows unlock code using Kaspersky Deblocker

What to do if the computer unlocking service did not help?

What to do, if computer unlocking service couldn't help? Unfortunately, Windows unlock code may simply not be included by the developers of the virus or, on this moment, may not be known to antivirus laboratories. In this case, the only way out is to treat your computer using a boot disk with an antivirus. In general, such a rescue disk can be recorded in advance and always available in case of infection by a ransomware Trojan. After all, on a locked computer it is no longer possible to visit online antivirus services and find the Windows unlock code!

Kapersky Rescue Disk Desktop

If none computer unlocking service didn’t help, a disk with boot antivirus Kaspersky Rescue Disk.

A similar article dedicated to the Dr.Web Live rescue boot disk is located.

And finally, the computer unlocking service provided by the foreign laboratory Eset

Another computer unlocking service provided by the Eset antivirus laboratory, manufacturer of the popular NOD32 antivirus. The Windows unlock service is available at the following link.

To receive a code to unlock your computer, you must fill out the data in the form provided on the page: the phone number to which you are asked to send an SMS and the text of the message displayed by the virus. Next, you need to click the “Select code” button.

Download boot disk with NOD 32 antivirus.

If you cannot find the Windows unlock code, use a rescue disk with NOD32 antivirus.

Antivirus computer help from a professional

If you can’t unlock your computer from a virus, help will come, which includes visiting a specialist, analyzing the infection, removing viruses and rootkits, restoring the system and installing a licensed antivirus.

Currently available online a large number of various services and programs for removing viruses and other malware. In this article I will talk about free program Kaspersky Virus Removal TOOL, with which you can remove unwanted advertising banners.

Download Kaspersky Virus Removal TOOL you can from the official website. You can read more about the terms of use in the user agreement.

Program installation:

Installing the program is quite simple. First you need to select a language. The installation wizard will then appear, accept the terms of the license agreement and click Next. Then you need to select the installation folder, click "Next". After this, the installation process of the program will begin.

Working with the program:

After launch Kaspersky Virus Removal TOOL The main menu of the program will appear on the screen (Fig. 1).

Select objects to scan by checking the appropriate boxes and click on the “Run scan” button. After this, a check of the selected elements will start (Fig. 2).

If infected files are detected during the scanning process, a window will appear (Fig. 3).

In this case, it is first suggested to disinfect the infected file; if treatment is impossible, then Kaspersky Virus Removal TOOL offers to delete the file, and if deletion is impossible, then the program offers to skip this file, and tries to isolate him. It is worth noting that for most infected files, either the disinfection or deletion function is triggered. In order to apply the selected action (“clean” “delete” “skip” for all detected malicious objects of this type check the box next to “Apply to all objects”).

Also under review Kaspersky Virus Removal TOOL can detect malware on your computer. In this case, a window will appear (Fig. 4).

In this case, in case of treatment, you will need to restart your PC.

After completing the computer scan, you can view the report. To do this, in the main program window, click the “Report” button. After this, a window will open with a report on the test performed (Fig. 5).

To view a detailed report, click on the icon next to the words “Automatic check”.

This is the process of working with the program Kaspersky Virus Removal TOOL completed, when finished, the program will offer to remove itself from your PC.

Today I will talk about how to remove a banner from your desktop. There are different types of ransomware banners: some only partially block the operation of the computer, others completely paralyze its operation. Last time, I just had to deal with the second type of banner.

The ransomware banner completely blocked the operation of my friend’s computer. The mouse cursor could only move within the boundaries of the banner. No keyboard shortcuts worked when trying to boot into safe mode appeared " blue screen of death".

The banner looked like this:

View of the ransomware banner on the desktop

The text, in my opinion, was compiled by a person with a good sense of humor:

“Your computer is blocked for viewing, copying and reproducing video materials containing elements of pornography, pedophilia and child abuse. To remove the blocking, you need to pay a fine of 1000 rubles to your MTS account; payment of the fine can be made at any payment terminal.

If you pay an amount equal to or exceeding the fine, an unlock code will be printed on the terminal’s fiscal receipt. You need to enter it in the field at the bottom of the window and press the “Enter” button. After removing the blocking, you must delete all materials containing elements of pornography, violence and pedophilia. If the fine is not paid within 12 hours, all data on your personal computer will be permanently deleted, and the case will be sent to court for trial under Article 242 Part 1 of the Criminal Code of the Russian Federation.

ATTENTION! Restarting or shutting down the computer will immediately delete all data, including operating system code and BIOS, with no further recovery possible."

In such cases, you can try going to the Kaspersky or Dr. website. Web using another computer and try to get the unlock code by entering the phone number to which they require you to send an SMS or top up your account. However, at the moment, banners that do not have unlock codes are widely used.

In this particular case, I used the Kaspersky Rescue Disk, the image of which (file with ISO extension) can be downloaded from the official Kaspersky Lab website or from the Depositfiles file hosting service (268 MB).

At the moment, Kaspersky Rescue Disk 10 is available for download. The disk image can be written to a flash drive or to a CD (CD-R or CD-RW). I prefer to use CDs, as this guarantees that after burning the image, the media will under no circumstances be infected with viruses.

Let me remind you that to boot your computer from a CD, the BIOS must specify the CD-ROM as the first boot device. To enter the BIOS, when booting/rebooting the computer, you usually need to hold down the Delete key. On some computers, other keys, such as F2, may be used to enter the BIOS.

When loading from Kaspersky Rescue Disk, you need to specify the language (English by default) and select the type of data display mode. For novice users, it is better to boot in graphical mode. After loading, in graphical mode, the desktop will appear.

Before you run a virus scan on your computer, you need to update the program. To do this, you can go to the “Update” tab and click on the “Perform update” link.

After the update, you need to return to the “Scan Objects” tab, select the objects that need to be scanned (it is advisable to select all disks) and start the scan by clicking on the “Run Object Scan” link.

After scanning your computer for viruses using the Kaspersky Rescue Disk utility, you can view the results on the “Reports” tab.

If everything goes well, after restarting the computer everything should return to normal. In my case, this is what happened; the ransomware banner was removed using Kaspersky Rescue Disk. By the way, it must be said that an attempt to remove such a banner using the Dr.Web CureIt! ended in failure.

Evgeny Mukhutdinov

While surfing the Internet, a user may accidentally visit a website that has been deliberately infected with a ransomware virus. If in the operating room Windows system, browser or other software there are vulnerabilities, the computer’s operation is completely blocked, a window appears on the screen with a message stating that the user allegedly violated certain rules and his Windows version blocked. To unlock, it is suggested to send an SMS message to the specified phone number. The cursor only moves in the window, rebooting does not help.

Removing ransomware viruses can be done in several ways. The easiest way is to use the Kaspersky Lab website: you need to log into it from another computer or under a backup OS and go to the “Removing SMS blockers” page. Next, enter the phone number to which you are asked to send an SMS into the search box and click the “Get code” button. If required code yes, you will get it. After that, enter it in the blocker window, Windows will be unlocked.

Unfortunately, this method does not always work. If unsuccessful, the banner can be deleted from using Kaspersky WindowsUnlocker. This utility can be downloaded from the same page of the Kaspersky website; it is included in the Kaspersky Rescue Disk. You need to download the disk image (its size is slightly more than 300 MB) and burn it to a CD. After this, the utility is launched from the CD when the computer starts; with its help, you can delete all SMS blocker files and restore the registry. After finishing the utility, the computer will be fully operational.

You should use Kaspersky WindowsUnlocker even if you managed to find the unlock code. The blocking virus files still remain on the computer and should be deleted.

Professional removal of blockers

Virus creators are constantly creating new versions, so there is a very high probability that you will not be able to remove the virus you encounter using standard methods. In this case, the banner will have to be deleted manual mode, which requires a lot of experience. For example, an experienced technician might try booting the computer in safe mode with support command line. When the console becomes available, he will launch the desktop with the command explorer.exe; the virus is usually not activated with this loading method. After this, the expert will check system registry And Windows folders, will manually remove blocker files from them, which will allow the computer to be fully functional again.

If you are faced with an SMS blocker and cannot get rid of it, call us. Our specialist will come and guarantee to restore your desktop or laptop. By watching a master at work, you can learn a lot, which will allow you to deal with similar situations on your own. Call us at any time convenient for you!

The following trouble can happen to anyone (or has already happened): one “fine” day you turn on the computer and instead of your usual desktop you see on the screen banner, requiring you to top up someone’s balance or send an SMS to a specific number to unblock. It is also reported here that the reason for this very blocking was that you allegedly viewed porn or somehow violated the law.

What this actually means is that your computer is infected with a virus, which completely blocks the workspace. Don’t even think about sending any SMS or adding money to the virus writers account – it won’t help anyway. Moreover, if you follow the advice I offer, getting rid of the ransomware banner is not so difficult.

Teme removing SMS banners from your computer I plan to devote several articles on my blog. But today I would like to talk about one of the simplest and most effective methods. Let's talk about the utility Kaspersky Windows Unlocker, which is included in the boot disk. It is intended precisely for those who do not want to go into details: which files are affected as a result of the actions of the ransomware virus; which registry branches are damaged and how to fix it manually. Easier this method, perhaps, only those listed below. But, unfortunately, they are ineffective.

So, a few words about advice found on forums on the Internet, but of little use.

1. Use unlock codes that can be found on the sites: Kaspersky Deblocker, DrWeb, Nod32.

The downside is that in order to find this saving code, you need to have access to the Internet from another computer (or other device). And to be honest, in my practice these codes were used very rarely.

2. Using “System Restore”, roll back to the restore point created before infection.

3. Run a full system scan with antivirus.

Regarding the second and third methods, I want to say the following: viruses found these days, as a rule, block the computer completely. Those. you will not only be able to get to your desktop (to launch the antivirus), but also even to call the “Task Manager” or log in through “Safe Mode”.

And one more method, which obviously cannot be called simple:

4. Remove yours HDD– connect it to another computer – scan it with the antivirus installed on that computer.

In this case, the virus itself may be able to be detected (and even removed). But then you will still have to deal with the consequences of the infection by correcting the values ​​in the damaged registry branches. In addition, carrying a hard drive back and forth, disconnecting and connecting it, is not the best idea.

And now more about the program Kaspersky Windows Unlocker. Kaspersky Lab specialists developed it specifically to combat ransomware viruses. This utility is included in the boot disk.

1. On an uninfected computer you need to download the image of this disk from here.

2. Burn the downloaded image to CD or DVD disc. You can do this using various programs(Nero, Ashampoo BurningStudio). I won’t go into detail on this (I’ll just say that I record images using Alcohol 120%).

3. Now we go to the infected computer, insert our disk into the drive and .

4. After loading, the following window will appear:
Within ten seconds, press any key on the keyboard.
Next, use the arrow on your keyboard to select the “Russian” language and press Enter.
Accept the terms of the license agreement by clicking “1”.
In the next window, go to the line “Kaspersky Rescue Disk. Graphics mode” and press the Enter key.
We wait a while until the desktop appears on the screen. If the “Network Settings” window pops up, just close it.

5. Now click the button in the lower left corner of the screen and select “Terminal”. In the window that appears, manually enter the command from the keyboard and press Enter.
As a result, a utility will launch that will disinfect the registry. When this operation is complete, close this window:
6. Now you must run a full computer scan with the program. Most likely, the program window will already be open on the desktop. If not, then click the button in the left corner again and select Kaspersky Rescue Disk. On the “Scan Objects” tab, check the boxes next to the objects that the program should scan, and then click the “Scan Objects” button. If viruses are detected, the program will report this and ask what to do with them (treat, quarantine, delete).