Codes to unlock your computer from the money ransomware virus. Ten ways to get rid of ransomware Trojans and unlock Windows

With the help of Trojans of the Winlock family, known as “Windows blockers,” ordinary users have been extorting money for more than five years. To date, representatives of this class malware seriously evolved and became one of the most common problems. Below we offer ways to combat them yourself and provide recommendations for preventing infection.

The appearance of a Trojan on a system usually occurs quickly and unnoticed by the user. A person performs the usual set of actions, browses web pages and does not do anything special. At some point, a full-screen banner simply appears, which cannot be removed in the usual way.

The picture can be openly pornographic, or vice versa – it is framed as strictly and menacingly as possible. There is only one result: in a message located on top of other windows, you need to transfer the specified amount to such and such a number or send paid SMS-message. It is often supplemented by threats of criminal prosecution or destruction of all data if the user does not hurry up with payment.

Of course, you shouldn’t pay extortionists. Instead, you can find out which operator cellular communications belongs specified number, and report it to security. In some cases, they may even tell you the unlock code over the phone, but you shouldn’t really count on it.

Treatment methods are based on understanding the changes that the Trojan makes to the system. All that remains is to identify them and cancel them in any convenient way.

With bare hands

For some Trojans there actually is an unlock code. In rare cases, they even honestly delete themselves completely after entering the correct code. You can find it out on the relevant sections of the websites of antivirus companies - see examples below.

You can access specialized sections of the websites of Doctor Web, Kaspersky Lab and other anti-virus software developers from another computer or phone.

After unlocking, do not rejoice prematurely and do not turn off the computer. Download any free antivirus and perform a full system scan. To do this, use, for example, the Dr.Web CureIt! or Kaspersky Virus Removal Tool.

Simple measures for simple horses

Before use complex methods and special software, try to make do with the available means. Call the task manager using the key combination (CTRL)+(ALT)+(DEL) or (CTRL)+(SHIFT)+(ESC). If it works, then we are dealing with a primitive Trojan, fighting which will not cause problems. Find it in the list of processes and forcefully terminate it.

The foreign process produces a vague name and no description. If in doubt, simply unload all suspicious ones one by one until the banner disappears.

If the task manager is not called, try using third party manager processes through the “Run” command, launched by pressing the (Win) + (R) keys. This is what a suspicious process looks like in System Explorer.

You can download the program from another computer or even from your phone. It only takes up a couple of megabytes. The “check” link searches for information about the process in an online database, but usually everything is clear. After closing the banner, you often need to restart Explorer (the explorer.exe process). In the task manager, click: File -> New task(run) -> c:Windowsexplorer.exe.

When the Trojan is deactivated for the duration of the session, all that remains is to find its files and delete them. This can be done manually or use a free antivirus.

A typical location for a Trojan is the user, system, and browser temporary files directories. It is still advisable to perform a full scan, since copies can be located anywhere, and trouble does not come alone. Look full list autorun objects will be helped by the free Autoruns utility.

Military stratagem

A peculiarity in the behavior of some standard programs will help you deal with the Trojan at the first stage. When you see the banner, try blindly launching Notepad or WordPad. Press (WIN)+(R), write notepad and press (ENTER). A new one will open under the banner Text Document. Type any abracadabra and then briefly press the power button on system unit. All processes, including the Trojan, will begin to terminate, but the computer will not shut down.

Notepad will stop the galloping horse and return access to the admin!

Old school

More advanced versions of Trojans have means to counter attempts to get rid of them. They block the launch of the task manager and replace other system components.

In this case, restart your computer and hold down the (F8) key while Windows boot. A window for selecting a download method will appear. We require "Safe Mode with Command Line Support" ( Safe Mode with Command Prompt). After the console appears, write explorer and press (ENTER) - Explorer will start. Next we write regedit, press (ENTER) and see the registry editor. Here you can find the records created by the Trojan and discover the place where it autoruns.

Most often you will see the full paths to the Trojan files in the Shell and Userinit keys in the branch

HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogon

In “Shell” the Trojan is written instead of explorer.exe, and in “Userinit” it is indicated after a comma. Copy full name Trojan file to the clipboard from the first detected entry. IN command line write del, add a space and call right key mouse context menu.

In it, select the “insert” command and press (ENTER). One Trojan file has been deleted, we do the same for the second and subsequent ones.

Removing a Trojan from the console - the file was in a temporary folder.

Then we search the registry by the name of the Trojan file, carefully review all the entries found and delete suspicious ones. We clear all temporary folders and the trash. Even if everything went perfectly, don’t be lazy and then run a full scan with any antivirus.

If they stopped working because of a Trojan network connections, try to restore Windows settings Sockets API AVZ utility.

Operation under anesthesia

It is useless to fight cases of serious infection from under an infected system. It’s more logical to boot into something that is known to be clean and calmly cure the main one. There are dozens of ways to do this, but one of the simplest is to use free utility Kaspersky WindowsUnlocker, included in Kaspersky Rescue Disk. Like DrWeb LiveCD, it is based on Gentoo Linux. The image file can be written to a blank or made from it bootable flash drive Kaspersky USB Rescue Disk Maker utility.

Prudent users do this in advance, while others turn to friends or go to the nearest Internet cafe during infection.

When you turn on the infected computer, hold down the key to enter the BIOS. This is usually (DEL) or (F2), and the corresponding prompt appears at the bottom of the screen. Insert Kaspersky Rescue Disk or bootable flash drive. In Boot options, select the drive as the first boot device optical disks or a flash drive (sometimes it may appear in the HDD drop-down list). Save changes (F10) and exit BIOS.

Modern BIOS version allow you to choose boot device on the fly, without entering the main settings. To do this, you need to press (F12), (F11) or a key combination - for more details, see the message on the screen, in the instructions for motherboard or laptop. After reboot it will start Kaspersky Rescue Disk.

The Russian language is available, and treatment can be performed automatically or manual mode – step by step instructions on the developer's website.

Early struggles

A separate subclass consists of Trojans that attack the main boot record(MBR). They appear before Windows boots, and you will not find them in the startup sections.

The first stage of dealing with them is to restore source code MBR. In the case of XP, for this we boot from installation disk Windows, by pressing the (R) key, call up the recovery console and write the fixmbr command in it. Confirm it with the (Y) key and reboot. For Windows 7, a similar utility is called BOOTREC.EXE, and the fixmbr command is passed as a parameter:

After these manipulations, the system boots again. You can start searching for copies of the Trojan and its delivery means using any antivirus.

On a crusade with a Phillips screwdriver

On low-power computers and especially laptops, the fight against Trojans can take a long time, since loading from external devices difficult, and verification takes a very long time. In such cases, simply remove the infected hard drive and connect it to another computer for treatment. To do this, it is more convenient to use boxes with eSATA interface or USB 3.0/2.0.

In order not to spread the infection, we first disable autostart from the HDD on the “treating” computer (and from other types of media it would not hurt). The most convenient way to do this is with the free AVZ utility, but it is better to perform the check itself with something else. Go to the "File" menu, select "Troubleshoot Wizard". Check " System problems", "All" and click "Start". After that, check the “Allow autorun from HDD” option and click “Fix noted problems”.

Also, before connecting an infected hard drive, you should make sure that resident anti-virus monitoring is running on the computer with adequate settings and there are fresh databases.

If the sections of the external hard drive are not visible, go to Disk Management. To do this, in the “Start” -> “Run” window, write diskmgmt.msc and then press (ENTER). The external hard drive partitions must be assigned letters. They can be added manually using the “change drive letter...” command. After that check external hard drive entirely.

To prevent reinfection you should install any antivirus with a real-time monitoring component and adhere to general rules security:

try to work from under account with limited rights;
use alternative browsers– most infections occur through Internet Explorer;
disable Java scripts on unknown sites;
disable autorun from removable media;
install programs, add-ons and updates only from official developer sites;
always pay attention to where the proposed link actually leads;
block unwanted pop-ups using browser add-ons or standalone programs;
promptly install updates to browsers, general and system components;
allocate a separate disk partition for the system, and user files store it on another.

Following the last recommendation makes it possible to make small images system partition(using Symantec Ghost, Acronis True Image, Paragon Backup and Recovery or at least standard means Windows “Backup and Restore”). They will help you to ensure that your computer is restored in a matter of minutes, regardless of what it is infected with and whether antivirus software can detect a Trojan.

The article provides only the basic methods and general information. If you are interested in the topic, visit the GreenFlash project website. On the forum pages you will find many interesting solutions and tips for creating a multiboot flash drive for all occasions.

The distribution of Winlock Trojans is not limited to Russia and neighboring countries. Their modifications exist in almost all languages, including Arabic. In addition to Windows, attempts are being made to infect Mac OS X with similar Trojans. Linux users It is not possible to experience the joy of victory over an insidious enemy. The architecture of this family of operating systems does not allow writing any effective and universal X-lock. However, you can “play doctor” on virtual machine with Windows guest OS.

If you have unwittingly become a victim of a so-called ransomware virus that has penetrated your computer, there is no need to rush to despair, because there is a simple solution thanks to which not a single malicious creature will linger in the system for a long time.

Ransomware virus

What is it and what does a ransomware virus look like?

A ransomware virus is malicious software that is designed to extort money from a victim, usually.

Computer news, reviews, computer problem solving, computer games, drivers and devices and others computer programs." title="programs, drivers, problems with the computer, games" target="_blank">Компьютерная помощь, драйверы, программы, игры!}

When you turn on the computer, instead of the usual desktop, a banner (splash screen) appears on the entire monitor screen with text demanding a ransom for access to the computer. This problem completely paralyzes the computer, preventing it from performing any actions. In general, nothing can be done until remove ransomware virus.

Attention! Do not agree or send the funds indicated in the banner text to the payment information provided. These are scammers! They promise to open access and remove the banner after payment!? It will not happen. The banner has hung and will continue to hang! All that can be done REMOVE RANSOM VIRUS!

Virus attack on the Ministry of Internal Affairs

On May 12 there was a mass virus attack on the computers of users around the world, the purpose of which was to install malicious software that demands a ransom for access to the computer. Many computers around the world have been affected WannaCry virus, which translated from English means “I want to cry.” So, to unblock the virus it was necessary to pay $300, after which, supposedly, the computer could be used without problems. Moreover, the funds had to be received in the Bitcoin cryptocurrency.

The victims include the Ministry of Health, the Ministry of Emergency Situations, and the virus attacked the Ministry of Internal Affairs and did not bypass Megafon and VimpelCom, tried to attack Sberbank. In Europe, the UK, where 50 hospitals were paralyzed, as well as Spain and Portugal suffered at the hands of cybercriminals. Worldwide, the virus attacked more than 200 thousand computers in 150 countries.

How to remove ransomware virus

1 In order to remove ransomware virus from your computer, you must follow special algorithm actions. Firstly, turn off the computer. We remember what we did on the computer the day before: this could be viewing unsafe resources, downloading and installing some software, including viewing photos, images, playing videos.

2 Secondly, if the computer is in local network It is quite possible that they caught the virus over the network. We disconnect from the local network, namely pull out the wire from network card on the computer.

3 Then, for the most complete and high-quality scanning of your computer for viruses, you need to download the Dr.Web Curelt utility to a USB flash drive. This can be done on any other computer with access to the Internet. Download Dr.Web Curelt.

Unblock ransomware virus

4 Start the computer in safe mode. In order to do this, immediately when turning on the computer, press the F8 button several times. After booting the computer (in safe mode), insert a USB flash drive with the Dr.Web Curelt utility and copy it from the flash drive to any folder on your hard drive.

5 Next, run the utility, wait until the computer is scanned and all viruses are removed, after which you can try to boot in normal mode. If the download was successful - Congratulations, you have removed the ransomware virus!

However, you should not rejoice ahead of time. Just removing the virus means defeating it in a particular case. In other words, the next attack will definitely get the virus onto your computer again.

WannaCry virus remove

In this case, immediately after loading Windows, you need to go to the list installed programs and check if everything is in order there, if there is anything suspicious, perhaps new recently installed programs or applications that are unfamiliar to you.

6 But the best way to do this is with Uninstall programs Tool - very powerful program, which allows you not only to remove programs, but also to completely clear all traces of its presence on the computer. In general, if you don't have this program, don't even try to look at it. standard list established Windows programs in the Control Panel, since the virus will not advertise itself and most likely you will not find anything there. Download Uninstall Tool.

Attention! Do not connect your computer to the network until you are sure that all computers on your local network have not been rendered harmless.

7 After checking the programs, as well as files on the computer, to see if anything is missing, basically, the names of your files, documents, etc. have not changed, you need to mandatory install good anti-virus protection, meaning install it on the computer to constantly protect the user’s PC. A good one can prevent the virus from re-entering your computer.

Of course, such an incident is widespread. Today's virus attack is the most massive in history. And most likely this is not the limit. This experience shows how unprotected we are from online cybercrime, but at the same time how dependent we are on computer technology, technology, electronics.

Perhaps now the Internet is at the peak of its popularity and the more popular it becomes, the more and more it attracts online criminals and hackers. The only way out of this situation could be a radical reform of the entire global network.

As a rule, this is a Trojan from the Winlock family. It is easy to identify: if an image of a pornographic or, conversely, business nature appears on the screen, and the computer stops responding to commands, this is our client.

The banner often contains the message “Your computer is blocked” and an offer to send a paid SMS or deposit money to a specified account - supposedly only after this the harmful banner (and with it the blocking of the PC) will disappear. The image even has a field where you need to enter special code, which should come after fulfilling the above requirements. The principle of operation of such malicious elements is to replace Shell parameters in the shell operating system and leveling the functions of Windows Explorer

There are several generations of ransomware viruses. Some of them are neutralized in a couple of clicks, others require more serious manipulations. We will give methods that, using which, you can cope with any Trojan of this kind.

Method No. 1

Task Manager

This method will work against primitive Trojans. Try calling the regular task manager (key combination CTRL+ALT+DEL or CTRL+SHIFT+ESC). If this succeeds, find in the list of processes what should not be running and terminate it.

If the dispatcher is not called, you can also use the process manager via the Win+R keys. In the “Open” field, enter the word “notepad” and press ENTER - this will open the Notepad application. In the application window that opens, type arbitrary characters and briefly press the on/off button on your laptop or desktop PC. All processes, including the Trojan, will end immediately, but the computer will not turn off. While the virus is deactivated, you can find files related to it and eliminate them or perform an antivirus scan.

If you haven't had time to install antivirus software, you may ask: how to remove ransomware from your computer? In most cases, the offspring of the evil Winlock family sneak into the directories of some temporary files or temporary files browser. First of all, check the paths:

C:\Documents and Settings\directory containing username\ and

C:\Users\directory by username\AppData\Roaming\.

There look for "ms.exe" and also suspicious files With random dialing characters like “0.277949.exe” or “Hhcqcx.exe” and delete them.

Method No. 2

Removing virus files in safe mode

If the first method did not work and Windows is blocked, what should you do in this case? There is also no need to get upset here. This means that we are faced with an advanced Trojan that replaces system components and blocks the launch of the Task Manager.

In this case, we will have to choose to work in safe mode. Restart your computer. When Windows starts, hold F8. From the menu that appears, select “Safe Mode with Command Line Support.”

Then in the console you should write: “explorer” and press ENTER - you will launch Explorer. After this, write the word “regedit” in the command line and press ENTER again. This will open the registry editor. In it you can find the records created by the Trojan, and also the place from where it autoruns.

The paths to the files of the malicious component will most likely be in the Shell and Userinit keys (in the first it is written explorer.exe, and in “Userinit” it can be easily identified by a comma). The next procedure is as follows: copy the full name of the detected virus file right click to the clipboard, write “del” on the command line, then put a space and paste the copied name. ENTER - and you're done. Now you know how to remove ransomware virus.

We do the same with other infectious files.

Method number 3

System Restore

We boot the system in safe mode, as described above. In the command line we write: “C:\WINDOWS\system32\Restore\rstrui.exe”. Modern versions will also understand simply “rstrui”. And, of course, ENTER.

The “System Restore” window will pop up in front of you. Here you will need to select a restore point, or rather, the date before the virus hit the PC. It could be yesterday, or it could be a month ago. In short, choose a time when your computer was 100% clean and healthy. That's all unlock Windows.

Method number 4.

Rescue disk

This method assumes that you have time to download the software from another computer or go to a friend to get it. Although, perhaps, you have already acquired it with the foresight?

Special software for emergency treatment and system recovery is supplied by many developers directly in anti-virus packages. However rescue disk You can also download it separately - free of charge and without registration.

You can use ESET NOD32 LiveCD, Comodo Rescue Disk, or . All these applications work on the same principle and can be placed on a CD, DVD, or USB drive. They automatically load along with the integrated OS (most often Linux), block Windows startup and, accordingly, malicious elements, scan the computer for viruses, remove dangerous software, and treat infected files.

If one fine day the following message appears on your monitor screen: Windows is locked! " (Windows is masculine?), and the reasons for blocking are banal and are possibly described in the virus blocking window itself Trojan.Winlock - "illegal access to materials with poor content..." etc. see screenshot of the Winlock window.

At the sight of this happiness, the user, who is in a pre-shock state, gradually comes up with a question - , and even without payment, and so that this muck doesn’t erase this... well, in general, you know what Windows, "operating rules"which are violated ( Has anyone seen these rules?).

We read: on "on the receipt you will find... a code", where to look for it? Maybe this tax number(TIN) of this individual entrepreneur ( they work on a large scale!) or the terminal itself is in the share, or maybe he is a villain-extortionist and a virus in one terminal, which prints activation numbers for every unfortunate user for 1000 rubles .

And the last phrase: " Attempting to reinstall the system will cause problems with your computer!“, completely and irrevocably kills all hopes of escaping from the virus, how much more disruption can there be in the operation of the system, if here and now there is no way at all? And there, then again?

But, let’s gather courage and return to the text of the blocker that brought our user into a stressful state.

These " actions", rather refer to the author of the virus Trojan.Winlock, and not to the poor user who, already in a pre-heart attack state, is crawling to the terminal with a thousand dollar bill in his hands in the hope of unlocking the computer.

And based on the verdict of the virus writer, he also violated: license for software operation an entire corporation! A complete program of violations of everything and everyone, which means it’s time to buy an indulgence.

This frightening text in the window was probably written just in case, so that the lucky person with a locked computer would not decide to complain to the authorities, because for contradictions UK RF, they certainly won’t give you a pat on the head!

- Contradicted the Criminal Code?! Violated exploitation?!- then answer, so and so, according to full program, in front of everyone Russian Federation and a volume Criminal Code of the Russian Federation hit you over the head so next time consistent.

It turns out there is also some kind of secret agreement." Software Operation Guide" between Microsoft and... someone?, which only the well-wishing author knows about ( wants good this is not a dirty word!) protecting the interests of a small, poor and unprotected foreign corporation located somewhere overseas - okiyan.

Complete graphomania, if you were to scare, you had to really scare, seriously, like:

pink bunny, in the form of a long-legged girl with fake bunny ears, showing an erotic striptease on your computer desktop and coyly offering unprecedented action (only today and now!) free unlocking your computer per purchase cash receipt in the nearest terminal for the amount of 1000 rubles,
for 2000 rubles - free to activate 2 computers,
and for 3000 rubles. strip naked for free only for you, and even on the desktop of your personal computer!

Super! There is something to pay for, otherwise replenish number, what if the number is not replenished? suddenly the number is already full,... some kind of nonsense. Yes, but where do they give discounts?, where are the bonuses finally?

How to unlock Windows for free from Trojan.Winlock ransomware virus?.

Attention. For cool specialists who do not want to read how to unlock Windows, we give the easiest way to remove a virus- delete all disk partitions, reformat the hard drive and you will receive an almost 100 percent guarantee of the destruction of the enemy, unless of course boot disk not infected, but this can be avoided low level formatting, if the chip is not infected, etc. until we reach the Chinese manufacturer.

Here is an image of a monitor screen with the window of the Trojan.WinlockTrojan virus.

The easiest way to unblock your favorite Windows for free and it’s easy, just go to the website of an online antivirus service Dr.Web, using any still living computer with Internet access, as a last resort, call a friend.

On the antivirus developers page Dr.Web in the window: " Computer unlocking service", enter the number in in this case phone number from the text of the ransomware, blocking virus: " top up MTS subscriber number: 79874498961".

As you understand, everything here is real and Trojan.Winlock virus, and subscriber 79874498961 , who is a real criminal with real details, address and passport data, because non-cash money always has a specific address, even if the passport is fake and phone numbers are bought in bulk.

Yes, and sites (domains are registered in Russia and paid for using passport data) distributing this malicious code They don’t hide or hide in corners, but are very respected by search engines and delight Internet users with such and such tricks

Not all owners of virus sites are rabid pests; many sites are simply hacked and infected with viruses. Yes and in Lately to its credit, the Yandex search engine warns the user about infected sites.

Screenshot of the Dr.Web page - "Computer unlocking service"

After entering the numbers of the ransomware number, press the button "Search for codes" and if you’re lucky, we’ll get what you need completely free of charge unlock code long-suffering Windows.

But in this moment, sorry, I can’t quickly get the code from the online antivirus service Dr.Web and get rid of the ransomware virus window with its stupid apocalypse inscriptions.

AND antivirus service Dr.Web suggests going to next step - determine the name of the virus from the image.

We follow the received link and on the first page of the antivirus service Dr.Web, we find exactly the same image of the blocker virus window Trojan.Winlock with relevant content ( the content in all the pictures is almost the same, you can feel the hand of the “poet”).

Next to the identified photo, on the antivirus web page Dr.Web, there is a column of activation codes, from which we select the necessary numbers to enter on a locked computer.

Random selection of unlock codes did not solve the problem.

Then, monotonously and in order, we begin to enter and check the numbers for activation.

It is very inconvenient to move the cursor over the buttons in the window of a locked computer, the movements of which are limited by a virus program. But on the fifth or sixth attempt, the virus swallowed the numbers and the long-awaited Windows desktop appeared.

Yeah! ( or like: wow, cool pepper)

Bang! and again the same funny picture overlaps open windows on the desktop.

There's a sponge hanging on a pole, start over.

There is no desire to brute force, we enter the same numbers, the virus is not greedy, it unblocked access.

We're waiting, maybe he'll learn something else. No, he’s silent, he’s calmed down. No variety. Boredom, honest some kind of virus, not according to concepts.

But if the option is with ready-made unlock codes Windows did not work or you are simply not interested in it, then the service Dr.Web offers to use free boot disks (You must download the disk image and burn it): Dr.Web LiveCD or Dr.Web LiveUSB, on the base Linux.

After booting from the selected media, you can scan your computer with a free antivirus program Dr.Web.

Bootloader menu photo Dr.Web LiveCD

With the help of always updated antivirus database Dr.Web You can check for viruses for free using the online service. separate files and links to web pages, for everyone popular browsers There is also a separate Dr.Web LinkChecker antivirus plugin

If you haven’t found the unlock code, don’t despair, there are alternative unlockers and the ability to send the code to specialists for free from the Dr.Web page

That's all, the saying is over and the fairy tale begins.

To clean and remove remaining viruses, we will use the following general algorithm:

The last point from the above is practically not done by any specialist, it is too expensive, labor-intensive and requires specific knowledge of setting up and administering Windows.
- And who knows what you yourself did before? Correct it, and then listen to the compliments.

Unblock Windows with other free online antivirus services.

Kaspersky Lab

Kaspersky Lab, Deblocker page: "Removing a banner from the desktop, unlocking Windows":
online service

Kaspersky Lab, page:" Kaspersky WindowsUnlocker utility to combat ransomware",
here is all the information about working with WindowsUnlocker, and you can also download special version image Kaspersky Rescue Disk(CD disc) or Kaspersky USB Rescue Disk (USB device) for computer treatment:
For links to antivirus programs, see the bottom of the page at support.kaspersky.ru

ESET LLC (NOD32 antivirus)

Company ESET, LLC (NOD32 antivirus), Windows unlock- online service

ESET Online Scanner, online scanning page ESET antivirus NOD32 - Online Scanner

Free boot disk LiveCD ESET NOD32 for operating system recovery – LiveCD

Kaspersky Lab and VirusInfo

Joint free online service Kaspersky Lab and the VirusInfo portal.

Page of the service "Deactivation of ransomware-blockers" - virusinfo.info

This is such a short algorithm, but it takes time.... So, let’s remember the wonderful poems Korney Chukovsky:

"Little children! Don't go to Africa for anything in the world, To go for a walk in Africa! There are sharks in Africa, There are gorillas in Africa, In Africa there are big Evil crocodiles They will bite you, Beat you and offend you, - Don't go, children, To go for a walk in Africa. In In Africa there is a robber, In Africa there is a villain, In Africa there is a terrible Bar-ma-lay!

The basis of the psychology of creating malware (read viruses, Trojans, etc.) is simple: first force the user to press a button and infect the computer, then intimidate the user, and then solve the problem for money.

At the present time, with modern development technologies and high data transfer rates, users personal computers, laptops, tablets and smartphones very often (even with installed antivirus protection) catch some kind of virus. Nowadays, programs that infect a device while blocking access to it with a banner on the desktop are very popular among hackers. How to unlock the computer in this case? How can I regain access to it?

What banners exist?

The most common are the following: Internet access is blocked, Windows is blocked, the rules for using the Internet have been violated, your account has been hacked and now spam is being sent from it, and so on. The computer owner is offered help in solving the problem. For this he is asked to send just one SMS via short number. By doing this, you will lose at least 250-300 rubles. And, accordingly, the banner in almost all cases does not go anywhere.

Basic ways to solve the problem

What to do? How to unlock your computer from a virus and continue to use your device? There are various methods of salvation. The main ones:

Restoring the operating system.
Removal virus program from OS startup.
Application of special unlock codes from Dr.Web and Kaspersky websites.
Using an antivirus.

It must be remembered that universal method There is no way to unlock your computer from a virus. Each of the above is only suitable for a specific situation. Now let's dwell on this a little.

Solving the problem via the Internet

This option is good for someone who has access to the network or has a connection with someone willing to help. The official websites of Kaspersky and Doctor Web have codes that can unlock your device. If they are not there, we go another way.

Removing the banner from startup

How to unlock your computer this way? This path is very simple. You need to boot your device in safe mode. To do this, press F8 when loading it. A menu with Windows boot options will appear in front of us. Choose the one you need. Then one of two things: the banner has not gone away, or the system will boot without the virus. In the latter case, click "Start" and enter msconfig in the command line. Go to startup, uncheck suspicious items there and reboot the PC.

Outdated unlocking method

If the banner has not disappeared, then you can try to unlock your computer from the virus using an outdated, but sometimes effective method. To do this, we reboot it in safe mode, and set the clock forward about a week. This may help, but most likely not for long, since viruses are also updated regularly. System time It is possible to change it in the BIOS. It is also possible to perform a system restore.

Powerful professional way

If all the previous does not help resolve the issue of how to unlock your computer, we will fight the banner using an antivirus. If you can access the desktop in safe mode, then use Removal-tool Kaspersky or Cureit Doctors Web, the most famous of all. If this is not possible, we use LiveCD - a special boot disk that loads the antivirus without any problems and removes the banner. To do this, we write its image onto a flash drive or disc, then onto a computer, after which we scan the system for viruses. This option can be difficult to use regular user, so it is recommended to turn to professionals. So we figured out how to unlock your computer.