How to unlock your PC from a virus. How to get rid of the threat and restore Windows functionality
Today we will learn how to remove the blockage from the operating room Windows systems.
One of common problems PC owners suffer from infection of their equipment with various types of viruses.
Today we will work with a ransomware virus.
This virus locks Windows for financial gain.
1. The result of this virus is the appearance of a dialog box that informs us that Windows is blocked due to illegal actions of the PC owner on the Internet.
Attackers indicate the operator's number cellular communication, number mobile phone and the amount by which you will supposedly receive a “magic” code that will unlock your operating system.
Most importantly, DO NOT SEND MONEY into the hands of scammers. They cannot take possession of, much less delete, existing files.
Now we will tell you how to remove the lock in order to gain access to the OP and data stored on the PC.
We will perform this procedure without formatting or reinstalling Windows.
2. So, let's get started, you turned on the PC and the lock window immediately appeared.
Mouse cursor movement is limited to the code entry area.
Accordingly, the cursor is completely useless.
We will act using "hot keys".
Press ctrl+alt+delete.
The system goes to the menu, but the cursor is again completely useless.
3. From the five menu items, select log out.
We have logged out, the mouse arrow now moves across the entire screen area.
4. Now our task is to create a new account.
Reboot the PC and press the F8 key when the system boots.
Now we are offered download options.
Choose safe mode with command line support.
5. Now we need to access the control panel to create a new account.
The system has booted and the command line is available to us.
In the window we type Control Panel and press the Enter key.
6. Now we have access to the control panel.
7. Create a new account with administrator rights and call it Admin.
Of course, by creating a new account we do not solve the problem of blocking the PC, we just get alternative access to the system.
Reboot the PC, also using the F8 key.
We boot the PC in normal mode.
8. There are now two accounts in the dialog box, log in using the Administrator account.
9. We gained access to the operating system and files.
Now we need to install a free antivirus program (we install Avast), which will identify infected files and safely disinfect them.
10. Also download CCleaner program, it will remove garbage from the PC and restore banal order.
Launch and install the downloaded antivirus program and the CCleaner program.
We check the laptop and cure it of infected files.
After this, we will reboot the laptop and log into the first account.
And we can delete the Administrator account, it will no longer be useful to you.
For other ways to cure your PC from ransomware viruses, see the following videos.
More detailed instructions You will receive instructions in the video below:
At the present time, with modern development technologies and high speeds data transfer, users personal computers, laptops, tablets and smartphones very often (even with installed antivirus protection) catch some kind of virus. Nowadays, programs that infect a device while blocking access to it with a banner on the desktop are very popular among hackers. How to unlock the computer in this case? How can I regain access to it?
What banners exist?
The most common are the following: Internet access is blocked, Windows is blocked, the rules for using the Internet have been violated, your account has been hacked and now spam is being sent from it, and so on. The computer owner is offered help in solving the problem. For this he is asked to send just one SMS via short number. By doing this, you will lose at least 250-300 rubles. And, accordingly, the banner in almost all cases does not go anywhere.
Basic ways to solve the problem
What to do? How to unlock your computer from a virus and continue to use your device? There are various ways salvation. The main ones:
- Recovery operating system.
- Removing a virus program from OS startup.
- Application of special unlock codes from Dr.Web and Kaspersky websites.
- Using an antivirus.
It must be remembered that universal method There is no way to unlock your computer from a virus. Each of the above applies only to specific situation. Now let's dwell on this a little.
Solving the problem via the Internet
This option is good for someone who has access to the network or has a connection with someone willing to help. The official websites of Kaspersky and Doctor Web have codes that can unlock your device. If they are not there, we go another way.
Removing the banner from startup
How to unlock your computer this way? This path is very simple. You need to boot your device in safe mode. To do this, press F8 when loading it. A menu with options will appear in front of us Windows boot. Choose the one you need. Then one of two things: the banner has not gone away, or the system will boot without the virus. IN the latter case Click "Start" and enter msconfig in command line. Go to startup, uncheck suspicious items there and reboot the PC.
Outdated unlocking method
If the banner has not disappeared anywhere, then you can try to unlock your computer from the virus using the outdated method, but sometimes effective method. To do this, we reboot it in safe mode, and set the clock forward about a week. This may help, but most likely not for long, since viruses are also updated regularly. The system time can also be changed in the BIOS. It is also possible to perform a system restore.
Powerful professional way
If all the previous does not help resolve the issue of how to unlock your computer, we will fight the banner using an antivirus. If you can access the desktop in safe mode, then use Removal-tool Kaspersky or Cureit Doctors Web, the most famous of all. If this is not possible, we use LiveCD - a special boot disk, which downloads the antivirus without any problems and removes the banner. To do this, we write its image onto a flash drive or disc, then onto a computer, after which we scan the system for viruses. This option can be difficult to use regular user, so it is recommended to turn to professionals. So we figured out how to unlock your computer.
Today we'll talk again about scammers who earn money from computer users without leaving their homes. Every 7th computer user has encountered a problem when, when turning on or restarting the computer, a message (banner) appears on the entire screen: “Your computer is blocked for viewing or copying, replicating anything.” They ask you to send an SMS to the number of any operator (MTS, MEGAFON, BEELINE), top up your account, and in return you will supposedly receive an unlock code. If you do not do this, then all information will be destroyed, the data will be formatted and you will never unlock the computer.
Probably every tenth user deposited this money in the hope of reviving a locked computer using a code, thereby filling electronic wallets hard working hackers. Remember: never send any SMS or deposit any money into a scammer’s account.
Now I will share with you a solution to defrosting a computer if it is already locked.
Method 1 - Editing the registry
Don't be scared)), it's very simple and won't take much time. If you don’t want to do this, call us and we will do everything for you. Let's do everything in order. To access the registry, you need to boot the locked computer into command line support. To do this, when you turn on the computer, press the F8 key and select Safe Mode with command line support in the boot menu that pops up.
We wait for the command line to load and enter regedit.exe in it and press Enter. The registry editor opened - this is where our blocking virus settled. The first place where a computer blocker could be:
1. HKEY_CURRENT_USER /Software /Microsoft /Windows /CurrentVersion /Run
here we see a list of startup programs (run along with the operating system), as well as their location on your PC (so that you can then remove them from the disk). All suspicious programs needs to be removed ( right click mouse and delete) and remember the path to them (for example: grg54545.exe, bh.exe along the path C:/Documents and Settings/; C:/Windows/System, etc.)
2.HKEY_LOCAL_MACHINE /Software /Microsoft /Windows /CurrentVersion /Run - repeat the above.
3. HKEY_CURRENT_USER /Software /Microsoft /Windows NT /CurrentVersion /Winlogon-
There should be no Shell and Userinit parameters here. If you find them, feel free to delete them.
4. HKEY_LOCAL_MACHINE/Software/Microsoft/WindowsNT/CurrentVersion/Winlogon - on the contrary, must be present and correspond to these values Userinit - C: Windows /system32 /userinit.exe
Shell - explorer.exe
If this is not the case, then correct it manually. Has everything been fixed? Now close the registry editor and enter Explorer.exe in the command line and press enter to launch the desktop. We delete the files whose paths we remembered and reboot. Your computer is unlocked. Voila! Everything should work.
Surely many fans of the Windows operating system are familiar with the situation when a banner appears on the monitor with the threatening words “Attention, your computer is locked!” And then follows a text threatening to delete all data from the computer in the near future. To prevent this from happening, it is proposed to pay the fine by depositing funds to the specified mobile number and get the unlock code. I can’t even remove the hated banner. When you turn it on again, it still appears on the monitor.
What to do if your computer is locked? Top up your account? No way! After depositing the specified amount or sending an SMS to the suggested number, the unfortunate user will not receive any unlock code, and the computer will remain locked. This is how the most common scammers operate and launch virus programs on computers and rely on the fact that there are naive users on the network. This type of Internet fraud has existed for a long time, and the fines are constantly growing. As a rule, the operating system is blocked when you try to play or download a video of dubious content.
So, the computer is locked and no actions are performed. What to do? In this case, you can do two things - contact a specialist or try to unlock the system yourself.
Unlocking via Safe Mode
There is a possibility that the banner reached your computer through a browser, which, when launched, may offer to restore the session. Under no circumstances should this be done.
Unlock viaBIOS
If your computer is locked, you can try to unlock it through the BIOS. You need to log into this system immediately after turning on the computer by pressing a certain button or different manufacturers These are different buttons and key combinations, for example: F1, F2, Del, and others.
Will open home page with system date and system time, where you need to change the date to a few days ago, that is, before the banner appeared. Then you need to save the changed dates by pressing F10 and exit BIOS systems. If this saving method does not work, you should go to Exit and select the “Saving Changes” item, highlight “Yes” and press Enter. After this, the system will start without a banner.
If these methods did not help and the computer is still blocked, you will have to use special program to destroy viruses. To do this, you will need another computer connected to the Internet. You need to go to Dr.'s website. Web, in order to download from there a program called Dr. Web LiveCD. The downloaded image must be burned to a CD using Nero programs and thereby get a boot disk. Then boot the locked computer from the disk on which you installed antivirus program. Now you need to configure Dr. Web and start scanning. There is a high probability that the fraudulent virus will be destroyed and the computer will turn on normal mode.
In some cases, none of the above methods help and you have to use last resort- reinstalling Windows.
