Working on the Internet carries the risk of infecting your personal computer with viruses. One of these viruses creates a screensaver on the desktop. To remove it, you need to send a paid SMS. It's called winlock.
Instructions
Step 1
Nowadays, to cope with this virus “Trojan. Winlock”is possible without the help of professional programmers. First of all, try to eliminate this malware using the LiveCD. This utility can be downloaded free of charge from the Dr. Web website by following the link (https://download.geo.drweb.com/pub/drweb/livecd/drweb-livecd-600.iso). On an uninfected computer, install the LiveCD onto a blank disk. Next, insert the CD into the drive of the infected PC and launch it. When loading BIOSa, the program will start automatically
Step 2
There is another way to deal with the virus. Antivirus software sites have created a database with numbers to which you want to send an SMS message on the splash screen.
Step 3
Go to the website of any of the anti-viruses: Dr. Web (https://www.drweb.com/unlocker/index/?lng=ru), Kaspersky (https://support.kaspersky.com/viruses/deblocker) or Eset Nod32 (https://www.esetnod32.ru/.support/winlock/). Specify the phone number to which you want to send an sms-message or message text. Click "Next" and you will be given a code to unlock your Windows and remove the screensaver. If none of the codes came up, contact the forum for technical support
Step 4
The next way to remove splash screen virus is System Restore. Boot the infected personal computer in Safe Mode. Call the "Task Manager" (Ctrl + Alt + Delete) by pressing hot keys. In the dialog box that appears, open the command line through the File tab. Now enter the code:% systemroot% system32
estore
strui.exe and press Enter. The standard system rollback program will start. Specify a time point and click "Next". This may damage some files.
Step 5
After restoring your system, download any trial antivirus and scan your computer thoroughly.
Step 6
If the splash virus allows you to enter the registry, then try in the HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersion. Window branch to delete the appeared parameter and restart the personal computer.
Step 7
After the virus is removed, purchase a full-fledged, licensed anti-virus program. This will help avoid re-infection.
