The procedure for removing a screen saver depends on the version of the Windows operating system installed and the functionality of the screen saver itself. If you can remove the standard screensaver using the standard system tools, then you will have to get rid of the ransomware screensaver by using additional programs.
Instructions
Step 1
Call the context menu of the desktop of a computer running Windows XP version by right-clicking and selecting the "Properties" item. Go to the "Screensaver" tab of the dialog box that opens and apply the checkbox to the "None" field. Confirm your choice by clicking OK (for Windows XP).
Step 2
Call the main system menu of a computer running Windows OS version 7 to remove the screen saver and go to the "Control Panel" item. Expand the Programs link and expand the Programs and Features node. Specify the screensaver to be deleted in the list and use the "Delete" button. Please note that it is not possible to remove the preinstalled screensavers (for Windows 7).
Step 3
Use a specialized free Dr. Web service called "Free Dr. Web Unblocker by Trojan. Winlock" and allows you to select a code to unlock the malicious ransomware screen saver. Then use Dr. Web CureIt! for the final removal of traces of the virus.
Step 4
Reboot your system and log on in safe mode. Expand the registry branch HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun and delete all files named indicdll. Repeat the same operation in the HKEY_CURRENT_USER section.
Step 5
Go to the path drive_name: Documents and SettingsAll UsersApplication Data and delete all files named blocker.exe and blocker.bin. Clean the% win root% system32 folder of servises.dll and servises.exe.
Step 6
Delete all files located in the folder under drive_name: Documents and Settings \% user% Local SettingsTemp and reboot the system. Log in using the standard method and run the registry editor utility.
Step 7
Delete the servises.exe key in the HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun branch. Then open the HKEY_LOCAL_MACHNESoftwareMicrosoftWindowsNTCurrentVersionWinlogon branch and delete all parameters after the userinit.exe value in the drive_name key: / Windows / system32 / userinit.exe.
