Viruses are spreading nowadays in every possible way and it is already difficult to find a person who, at least once in his life, has not bothered to face such a difficult task as an SMS banner. If this incident happened at work or at home, it causes embarrassment in front of colleagues and inconvenience in front of loved ones. What can be done? How can I get rid of such an annoying virus program on my own?
In one of the previous articles, I wrote about how to remove an SMS banner using DrWeb Live CD. In this article, we will look at the anti-virus software Kaspersky Rescue Disk, with which you can easily cope with the task yourself and remove the SMS banner yourself. So, let's begin. By the way, watch our video lesson!
We select the language and press “ENTER”, read the license agreement and naturally agree with it by pressing the “1” key.
If all conditions have been met, the independent download continues. operating system Kaspersky Rescue Disk, All you have to do is wait for the system window to appear:
If your computer is connected to Internet networks It is advisable to check for updates by going to the “Updates” tab and pressing the “Run updates” button; when the updates are complete, you should return to the “Checking objects” tab.
Where should you select a system scan using the following parameters “Boot sectors”, “ Hidden objects autostart", and local disks in this case "C". For more confident scanning, you should select the maximum. After which the system check will begin.
Also, for convenience, the independent OS has a built-in registry editor and WEB site browser where you can get the information you are interested in.
If you have any questions, ask them on my forum and I will definitely answer. You can also order a computer repair service at home with an on-site visit to Moscow.
The following trouble can happen to anyone (or has already happened): one “fine” day you turn on the computer and instead of your usual desktop you see on the screen banner, requiring you to top up someone’s balance or send an SMS to a specific number to unblock. It is also reported here that the reason for this very blocking was that you allegedly viewed porn or somehow violated the law.
What this actually means is that your computer is infected with a virus, which completely blocks the workspace. Don’t even think about sending any SMS or adding money to the virus writers account – it won’t help anyway. Moreover, if you follow the advice I offer, getting rid of the ransomware banner is not so difficult.
Teme removing SMS banners from your computer I plan to devote several articles on my blog. But today I would like to talk about one of the simplest and most effective ways. Let's talk about the utility Kaspersky Windows Unlocker, which is part of boot disk. It is intended precisely for those who do not want to go into details: which files are affected as a result of the actions of the ransomware virus; which registry branches are damaged and how to fix it manually. Easier this method, perhaps, only those listed below. But, unfortunately, they are ineffective.
So, a few words about advice found on forums on the Internet, but of little use.
1. Use unlock codes that can be found on the sites: Kaspersky Deblocker, DrWeb, Nod32.
The downside is that in order to find this saving code, you need to have access to the Internet from another computer (or other device). And to be honest, in my practice these codes were used very rarely.
2. Using “System Restore”, roll back to the restore point created before infection.
3. Launch full check antivirus systems.
Regarding the second and third methods, I want to say the following: viruses found these days, as a rule, block the computer completely. Those. you will not only be able to get to your desktop (to launch the antivirus), but also even to call the “Task Manager” or log in through “Safe Mode”.
And one more method, which obviously cannot be called simple:
4. Remove yours HDD– connect it to another computer – scan it with the antivirus installed on that computer.
In this case, the virus itself may be able to be detected (and even removed). But then you will still have to deal with the consequences of the infection by correcting the values in the damaged registry branches. In addition, carrying a hard drive back and forth, disconnecting and connecting it, is not the best idea.
And now more about the program Kaspersky Windows Unlocker. Kaspersky Lab specialists developed it specifically to combat ransomware viruses. This utility is included in the boot disk.
1. On an uninfected computer, you need to download an image of this disk from here.
2. Burn the downloaded image to CD or DVD disc. You can do this using various programs(Nero, Ashampoo BurningStudio). I won’t go into detail on this (I’ll just say that I record images using Alcohol 120%).
3. Now we go to the infected computer, insert our disk into the drive and .
4. After loading, the following window will appear: 
Within ten seconds, press any key on the keyboard.
Next, use the arrow on your keyboard to select the “Russian” language and press Enter.
Accept the terms license agreement by pressing “1”.
In the next window, go to the line “Kaspersky Rescue Disk. Graphics mode” and press the Enter key. 
We wait a while until the desktop appears on the screen. If the “Network Settings” window pops up, just close it.
5. Now click the button in the lower left corner of the screen and select “Terminal”. 
In the window that appears, manually enter the command from the keyboard and press Enter. 
As a result, a utility will launch that will disinfect the registry. When this operation is complete, close this window: 
6. Now you must run a full computer scan with the program. Most likely, the program window will already be open on the desktop. If not, then click the button in the left corner again and select Kaspersky Rescue Disk. 
On the “Scan Objects” tab, check the boxes next to the objects that the program should scan, and then click the “Scan Objects” button. 
If viruses are detected, the program will report this and ask what to do with them (treat, quarantine, delete).
On this moment The network offers a large number of different services and programs for removing viruses and other malware. In this article I will talk about free program Kaspersky Virus Removal TOOL, with which you can remove unwanted advertising banners.
Download Kaspersky Virus Removal TOOL you can from the official website. You can read more about the terms of use in the user agreement.
Program installation:
Installing the program is quite simple. First you need to select a language. The installation wizard will then appear, accept the terms of the license agreement and click Next. Then you need to select the installation folder, click "Next". After this, the installation process of the program will begin.
Working with the program:
After launch Kaspersky Virus Removal TOOL The main menu of the program will appear on the screen (Fig. 1).
Select objects to scan by checking the appropriate boxes and click on the “Run scan” button. After this, a check of the selected elements will start (Fig. 2).
If infected files are detected during the scanning process, a window will appear (Fig. 3).
In this case, it is first suggested to disinfect the infected file; if treatment is impossible, then Kaspersky Virus Removal TOOL offers to delete the file, and if deletion is impossible, then the program offers to skip this file, and tries to isolate him. It is worth noting that for most infected files, either the disinfection or deletion function is triggered. In order to apply the selected action (“clean” “delete” “skip” for all detected malicious objects of this type check the box next to “Apply to all objects”).
Also under review Kaspersky Virus Removal TOOL can detect malware on your computer. In this case, a window will appear (Fig. 4).
In this case, in case of treatment, you will need to restart your PC.
After completing the computer scan, you can view the report. To do this, in the main program window, click the “Report” button. After this, a window will open with a report on the test performed (Fig. 5).
To view a detailed report, click on the icon next to the words “Automatic check”.
This is the process of working with the program Kaspersky Virus Removal TOOL completed, when finished, the program will offer to remove itself from your PC.
Hello readers of the ComService company blog (Naberezhnye Chelny). In this article we will look at ways to remove a banner from your desktop. This can happen not only due to visiting sites with erotic content, but also when using cracks or keygens downloaded from unknown sources. Therefore, try to download software only from manufacturers' websites. If you receive a suspicious file, do not be lazy and . Typically, such banners are called extortionists, as they demand money from the user. This can be like sending an SMS to a short number or topping up your account in the system electronic payments. Fraudsters usually write on such banners that the user has violated the law, for which they are required to pay a fine. In this article we will tell you how to unblock your computer from such banners.
Article structure
Introduction
These services are easy to use, but there are no guarantees. You can spend a lot of time but still not unlock the system. But you definitely need to try it.
To use, you need a device (another, tablet or phone) with Internet access. Go to any of the listed addresses. Let's take Kaspersky for example.
In a special field you must enter the phone number or account to which you want to transfer money. If you are asked to send an SMS to short number, then write down this number and, separated by a colon, the text that needs to be sent. Afterwards, click Get code
The search results will appear below. Choose your banner and try the codes against it.
If you haven’t found your banner, try on the Dr.Web or Eset website. If this method did not help remove the banner from your desktop, read on.
2. Use System Restore
This option is good if you have this function enabled. If it was disabled, proceed to the next step.
In order to remove the banner from the desktop using system recovery, restart the computer and press F8 several times when loading. If a list of devices from which booting is possible appears, select your drive ( or ) and continue pressing F8 again. You should see a similar picture below. You need to select the System Troubleshooting option highlighted by default
A window will load where you need to select a language, then a user. Next there will be a window with a choice of several recovery options. Choose System Restore. Then select a restore point and return the computer to that point in time. First, take the nearest restore point; if that doesn’t help, restore to an earlier one.
You can read more about how to use System Restore.
3. Remove the banner from safe mode
By checking Dr.Web Cureit or analogues
There are banners that are not active in . You need to take advantage of this. To prepare for treatment, you need to download the Dr.Web Cureit utility on a healthy computer by opening the following link in your browser.
To remove a banner from your desktop by cleaning the registry, you need to check several points in the registry.
On the left side of the window go to the address
HKEY_CURRENT_USER -> Software -> Microsoft -> Windows -> CurrentVersion -> Run
Go to right side and delete all items except one (Default) for which the value is not assigned. Click right click on the item and select Delete. With this action we will remove the banner from Windows startup. (You can read how to control startup of Windows 7 and Windows 8 when the computer is in working order.)
All the above steps must also be performed in the section
HKEY_LOCAL_MACHINE -> Software -> Microsoft -> Windows -> CurrentVersion -> Run
There are two more places left to check
HKEY_CURRENT_USER -> Software -> Microsoft -> Windows NT -> CurrentVersion -> Winlogon
In this we check the absence of Shell and Userinit items. If they are there, delete them.
HKEY_LOCAL_MACHINE -> Software -> Microsoft -> Windows NT -> CurrentVersion -> Winlogon
check the values of the above points
Shell = explorer.exe
Userinir = C:Windowssystem32userinit.exe, (comma required)
If the values are different, we correct them to the correct ones.
We close the registry editor and, to be on the safe side, check the computer with the utility, or if you haven’t checked it before editing the registry.
After checking, reboot into normal mode and check whether the banner is removed.
4. Use Kaspersky WindowsUnlocker to remove a banner from the desktop
Using this utility, you can disinfect all operating systems installed on your computer. It does automatically what we did manually in the previous paragraph. This utility included in Kaspersky Rescue Disk.
You can download the Kaspersky Rescue Disk image from the official website here
To register at USB device It’s better to use the utility from the manufacturer
In the program window, use the Browse button to specify the path to the Kaspersky Rescue Disk image. You insert the USB drive into the computer and it immediately appears in the appropriate section. If this does not happen, select it manually.
Attention! Save all important data from your USB drive.
After all the settings, press the START button
The image will be written to the USB drive. If the process completes successfully you will see the following window. Click OK and close the rescue2usb program
Now you need to boot from the prepared USB storage on an infected computer. To do this, insert the USB flash drive into the computer and reboot. When you boot your computer, press F8 several times to bring up a list of devices that can boot from. Select the connected USB drive. (There may be two inscriptions in this list suggesting booting from USB. Try one first, then the other). If you can’t boot from a flash drive, you need to set boot from a USB drive in the BIOS. You can read how to do this.
After all the settings, it will boot from the USB drive and you will see the following window. You must press any key within 10 seconds
Select the required language using the arrows on the keyboard
You must accept the license by pressing button 1 on the keyboard
Select the Kaspersky Rescue Disk download mode. If you don't have a mouse, choose text. In all other cases, select graphics mode
In the terminal, type windowsunlocker and press Enter
If you have chosen text mode, then use the F10 key to close the menu that appears and type windowsunlocker in the line under file manager. Press Enter
To remove the banner from the desktop, press 1
After all the manipulations, you must press 0 - Exit.
After unlocking the operating system, you need to update the Kaspersky Rescue Disk databases and perform a full scan of your computer. To do this, open the main menu and select Kaspersky Rescue Disk. Go to the update tab and click Run update. In this case, the Internet must be connected to computer
Go to the Scan objects tab and select all objects in the field 2. Click Scan objects
Wait until the scan is completed and delete or disinfect any malicious files found. Afterwards, reboot in normal mode and check whether the banner is removed from the desktop.
5. Fixing the boot record
If the virus loads immediately when you turn on the computer before the operating system logo appears, then this infection has changed the boot record of your drive.
You need to log into the console Windows recovery and try to restore the boot record.
To open the recovery console, you must press the F8 key at boot, as if you were selecting safe mode. When a window appears with a choice of download options. At the very top, the item selected by default will appear - Troubleshoot system problems. Select this item by pressing Enter
A selection window will then appear user and entering your password. Select a user and enter a password if you have one and click Next
A window will then appear with system recovery options. There you can choose to restore the computer from an image (which is done in Windows) or execute (if it is enabled. See point 3 of this article) and much more. You select the last item Command Prompt.
In it you type BOOTREC.EXE /FixBoot
Then reboot and check whether the banner has been removed from the desktop.
6. Check the drive on a healthy computer
If you have the opportunity to test your drive on another computer do it.
Turn off your computer. Disconnect. With it turned off, connect it to another computer. Boot up. Update your anti-virus databases and scan the connected disk for viruses. I like this option the most because it is possible. If it is not there, use the options described above.
I hope it won't come to a reinstallation and it will help you Which-something described above.
Conclusion
In this article on how to remove a banner from the desktop, we looked at a lot of ways to successfully unlock the operating system. The main thing we need to understand is that there is no need to send any SMS or top up any accounts.
Of course, it’s worth starting the unlocking process by using the services provided by large antivirus companies. Such services are described in the first part of this article. The next best thing to do is to restore the system one, two or three times back. In general, the service can be of great help in critical situations. I highly recommend turning it on and allocating several gigabytes for it in the settings. If recovery fails, then proceed to treatment in. Unless, of course, the virus blocks everything there with its banner.
If with safe mode it doesn’t work, Kaspersky WindowsUnlocker as part of Kaspersky Rescue Disk is perfect solution. If possible, you can and should check your drive on the healthy machine of your relative, friend or neighbor. Don't worry, the virus won't jump to another computer. If the virus is registered in boot entry, then try through the recovery console. If all else fails (which is unlikely), then it is better to reinstall the operating system.
Video on how to unlock a computer from a banner Thanks for sharing the article on in social networks. All the best!
Users who do not use a reliable antivirus protection for, may encounter the problem of blocking the boot of the computer or desktop malware, which they require you to send an SMS with a text to a specific number to receive an unlock code.
Never fall for SMS scammers. The cost of a sent SMS is usually several hundred rubles, but the user does not always receive a code for this money (often SMS extortionists do not involve sending any codes at all); even more rarely, the received code helps to unlock the system.
You can catch this joy when viewing Internet pages with “dubious” content, while you are asked to install new version player or browser. An unsuspecting user agrees to the installation and thereby voluntarily installs an SMS virus on his computer.
Visually, these Trojans look like a banner window, a message about a pirated copy of your Windows, or a warning from the Ministry of Internal Affairs. Example message text: " Windows is locked. To unlock, you need to send an SMS with the text 446412302876 to the number 3786. An attempt to reinstall the system may lead to loss important information and computer problems", often the user is simply intimidated by the crash of the system and the loss of important data, which is not true. Trojan.Winlock also blocks the task manager, system registry, Internet (only access to anti-virus sites can be blocked).
Always install system components, codecs, browsers or programs only from official sources; for your convenience, our website has special sections for downloading the necessary distributions from official sites.
Therefore, if you have a question: " How to unlock a computer from a banner", then we offer you the opportunity to independently remove the banner from your desktop. To do this, follow the links below to special sections of anti-virus companies to receive the code. On the site, when filling out the form, you will need to indicate what text you are asked to send, and to what number.
Windows unlock codes on antivirus company websites
- Get the unlock code for the banner on the Kaspersky website;
- Get the banner unlock code on the Doctor Web website;
- Get the banner unlock code on the NOD32 website
Update 2020
Unfortunately, the developers of these antiviruses have removed the ability to receive a code to unlock your PC. Nowadays, the current method is to remove the SMS ransomware banner using a bootable LiveCD. You can also use Windows utility Unlocker on the Kaspersky Lab website.
Removing a banner using Windows Unlocker
Attention! Job Windows Unlocker may cause inoperability operating system.
Loading...
