Very often, reckless users catch malware, in other words, viruses that then come out on their desktops with banners asking to send an SMS to a specific number. Even if you send an SMS, there is no guarantee that the picture will disappear from the desktop as a result. Therefore, in no case do this!
Necessary
Computer, internet connection, anti-virus (paid or free), process manager (like Anvir Task Meneger)
Instructions
Step 1
The easiest way:
Try to roll back the system: "Start" - "Programs" - "Accessories" - "System Tools" - "System Restore" - "Restore an earlier state of the computer."
Choose a date earlier than the one when the banner appeared, but keep in mind that in this case, all those programs that you installed after the date of the restore point may disappear. Unfortunately, this method may not help if there is no earlier version of the restore point. Then move on to the next option:
Press CTRL + ALT + DELETE to open Task Manager and try to find the process that displays the banner on your desktop. If you are familiar with most Windows processes, then you will easily find suspicious. Usually it is disguised as the necessary system processes, but it can be distinguished by superfluous or similar characters in the name, for example, svnost.exe instead of svhost.exe, or distinguished by the place where the process is started, for example, the svhost.exe process running in the My drawings”is clearly malicious.
Information on the processes can be found here
If you manage to find and "kill" the malicious process, the banner will disappear, but will reappear the next time the system boots. To prevent this from happening, delete the file of the malicious process from the disk and the entry about its launch at startup, or better run the antivirus and thoroughly scan the system. Delete the virus files.
Step 2
Due to the huge influx of such viruses, antivirus companies provide services to search for codes from banners. Search for the code you need using these links:
support.kaspersky.com/viruses/deblocke https://virusinfo.info/deblocker/ https://esetnod32.ru/support/winlock.php https://www.drweb.com/unlocker/index https://news.drweb.com/show/?i=304&c=5 https://netler.ru/pc/trojan-winlock.htm And some even provide free utilities for removing banners
Especially cunning viruses, along with displaying a banner, overwrite the hosts file in the system so that you cannot use search engines and the websites of antivirus companies. In this case, open the file C: / WINDOWS / system32 / drivers / etc / hosts with a regular notepad (make hidden and system files and folders visible in the directory view settings). Then remove from the hosts file all the lines following the line 127.0.0.1 localhost - now, as a result of this action, you can go online and use the above tips.
Step 3
In severe cases, viruses overwrite the location of the hosts file in the system registry so that you cannot find it at C: / WINDOWS / system32 / drivers / etc / hosts. To find the "etc" folder, you need to see where it is located in the registry.
To do this, go to the registry (regedt command or Win + R regedit), then go to the address "HKEY_LOCAL_MACHINE / SYSTEM / CurrentControlSet / services / Tcpip / Parameters" and look at the value in DataBasePath (where the etc folder is located in which the file hosts).
If the above steps did not help you in any way, use heavy artillery (but you do not need to reinstall the system!).
Option 1:
Download here https://www.freedrweb.com/livecd/?lng=ru LiveCD, burn the disk image to CD, reboot, enter BIOS, specify boot from CD-ROM in BIOSe, boot from burned CD and thoroughly scan your computer for viruses … If you have a laptop, then just make a bootable USB flash drive and boot from it
Option 2:
Turn off your computer, remove the hard drive and contact a friend with a good antivirus or the Internet, where safely scan your hard drive with an antivirus, find a virus on it and remove it.
