When surfing the web, it is easy to fall prey to intruders injecting malware onto other people's computers. To do this, just click on the seductive picture, download a free program, or follow the link promising fabulous earnings or intriguing information. As a result, after turning on the computer again, you may see a viral banner interfering with your work.
The banner appears after loading Windows
Usually, the banner looks like a window with a message about blocking Windows due to your violation of some agreements (for example, watching child porn) and the requirement to transfer a certain amount to a web wallet or phone number. In return, the attackers promise to remove the lock or send an SMS with the unlock code. The virus can also look like an intrusive advertising window or an obscene picture. Do not transfer money under any circumstances - it will not help. You can cope with troubles on your own or using Internet services.
Use the Ctrl + Shift + Esc keys to invoke the task manager. In the "Applications" tab, find the name of the banner and uncheck the task. You can do otherwise: use the Win + D keys to minimize all open windows. Right-click on the banner window in the taskbar and select “Close”.
Click Win. In the "Programs" section, expand "Accessories", "System Tools" and select "System Restore" if you have this function enabled. Check "Restore to an earlier state" and click "Next".
Pick a date a few days before the trouble starts.
If the virus remains after restarting the computer, try manually removing entries from the registry that initiate the virus launch. Minimize and close the banner window as described above. Press Win + R and enter the regedit command in the program launcher window. Open the HKEY_LOCAL_MACHINE / Software / Microsoft / Windows NT / CurrentVersion / Winlogon branch. On the right side of the window, find the Shell and Userinit options. For Shell, Explorer.exe should be entered in the "Value" field, for Userinit - C: / Windows / system32 / userinit.exe. If there are any more characters, remove them.
Run a deep scan of your computer with an antivirus. You can use the free Dr. Web CureIt utility. Disable the antivirus installed on your computer beforehand, as the utility may consider its activity suspicious and dangerous.
You can enter the phone number or wallet number to which the extortionist wants to transfer money into the search bar of your browser. Kaspersky Lab and DrWeb specialists may have found unlock codes for this banner. There are usually several options for codes. Enter them one by one in the input field until it works (it is possible that this will not happen, since you have come across a new modification of the virus).
The banner appears before Windows boots
In this case, the banner completely blocks the operation of the operating system. Restart your computer and press F8 before Windows starts loading. In the menu of boot options that appears, check "Load Last Known Good Configuration". Indicate the date when the computer worked correctly.
If this option does not help, restart your computer again and select "Safe Mode with Command Prompt". In the window that opens, write down the cleanmgr command, which removes unnecessary files from the hard drive. When it finishes running, enter the rstrui.exe command, which rebuilds the system by bringing the system files back to work.
In the most severe cases, if the banner could not be removed, move the hard disk to another computer as a slave and run a deep scan with an antivirus.
