Among the many dangers that lie in wait for a novice user on the Internet, one of the most unpleasant is the Winlock virus. Infection of the computer with this virus leads to the appearance of the so-called "blocking banner".
What does a blocking banner look like?
The blocking banner is a pop-up window that appears immediately after the computer boots. Typically, this window contains accusations of various dubious activities, such as watching an adult video, using an unlicensed copy of the operating system, or storing pirated files. The modifications of the virus can be different, but the point comes down to one thing - a ransom demand.
To get rid of the intrusive banner, it is proposed to send an SMS to a short number or to top up the account of a specific mobile phone through payment terminals. In response, supposedly, you should receive a password, by entering which you can restore access to your computer. Naturally, this should never be done, because even if the code sent to you turns out to be correct, the virus will not disappear from the computer, and in a week you will again find the blackmail banner.
You can get rid of the ransomware virus by contacting people involved in minor computer repairs and related services, but the cost of such assistance will be even slightly higher than the amount required by the virus.
Please note that all threats that are usually contained in the banner text (for example, formatting the hard drive or destroying BIOS data if the code is not entered for some time) are a common bluff intended for inexperienced users. Do not panic and send SMS, fearing for your data, it is better to just turn off your computer and start solving the problem.
How to deal with blocking?
In fact, Winlock viruses are quite common, so there are plenty of tools to fight them. For example, on the websites of antivirus manufacturers, you can find code tables that allow you to remove a blocking banner. Naturally, after that, the computer will need to be checked with an antivirus in order to get rid of the virus itself, but it is not difficult to do this after gaining access to the desktop.
As a rule, the ransom amount is about 400 rubles, but it can vary depending on the modification of the virus.
In addition, in some cases, a regular restart of the computer or booting in safe mode can help. To do this, you need to go to the Windows Advanced Boot Options menu and select the appropriate mode. Typically, the menu opens by pressing the F8 key during computer startup. If these manipulations do not help to bypass the blocking banner, then you will have to find a boot disk or USB flash drive and boot from it. In this case, not your main operating system will be launched, but the auxiliary one installed on the boot disk. After that, you just have to clean your hard drive with an antivirus.
