Of all the types of malware, the WinLocker, a type of Trojan horse, is perhaps the most annoying for the user. They almost completely block the operation of the system, cover the screen with their window and require an SMS to be sent to a paid number in order to receive an unlock code. Dealing with a winlocker is not easy, and all methods require some computer knowledge.
Instructions
Step 1
The best treatment is always prevention. Remember that in most cases blocking programs do not secretly enter your computer - you install and run them yourself. Therefore, when surfing the Internet, be careful.
Step 2
If a pop-up window on a site prompts you to urgently update the codec, download a new version of a plug-in or check the system with the latest online antivirus, do not agree if you do not know for sure that this site can really be trusted. Close such a window as quickly as possible, and best of all - with the site. Then check the system with your own antivirus.
Step 3
Install a high-quality Internet protection system on your computer. It is desirable that it includes not only antivirus, but also a firewall. A properly configured firewall will stop many threats before they even have time to settle in the system.
Step 4
If you have already suffered from a running winlocker - in no case agree to its terms and do not send SMS! Its cost may turn out to be much higher than what scammers write in their program window. Moreover, having agreed once, you may find that money continues to be debited from your mobile account, allegedly as a subscription fee for a non-existent service. Getting rid of such a subscription will not be easy.
Step 5
Some manufacturers of domestic antiviruses offer an online service that supplies unlock codes for many well-known winlockers. Of course, you can use this service only from another, not infected computer. Enter in the service window the number to which the scammers offer to send an SMS, and write down the code. However, remember that even if the malware has shut down, it does not mean that it is gone. Unlocking the system is just the beginning of the steps to clean it up.
Step 6
If you have a bootable LiveCD, boot from it. Antivirus vendors often include their own version of the LiveCD, which automatically checks the system for viruses upon boot. However, new versions of winlockers appear so often that antivirus cannot always detect them.
Step 7
After booting from disk or unlocking the system, use the standard search tool to find all executable files created on that day. If such files appear in the Windows system folders or in your regular download folder - most likely, this is the main body of the winlocker. Delete these files, but remember their names.
Step 8
Open the Windows registry. Be careful - when booting from the Live CD, a temporary registry of the system in which you are currently working may open instead. Your best bet is to find the main registry file in the Windows folder and open it in regedit. Find the names of the Winlocker files among the registry entries. If they replace system files such as explorer.exe or ctfmon.exe, correct these entries, otherwise just delete them.
Step 9
Restart your computer normally and restore the system configuration from the last checkpoint. The recovery program is located in the menu at "Accessories - System Tools - System Restore".
