What is WinLock virus?

WinLock virus – is a family of viruses, that blocks or hampers the work with operating system and extorts money from infected PC users. You may know them as Trojan.Winlock, Trojan.Ransom, Trojan.ScreenLock. For unlocking you should pay ransom, using electronic payment system.

There are 3 types of WinLockers:

• Banners, which are displayed only in browsers. They are poses as browser extension and plug-ins;
• Banners, that fill the desktop. Users still can run programs, including Task Manager and Registry Editor;
• Banners, that run with operating system and fill the desktop, block Task Manager, Registry Editor and SafeMode.

How WinLock virus infected my PC?

There are many ways to be contaminated, but mostly virus uses weakness of the browsers, while user visits malicious website. Another popular way – is files, which are masked as installation of a good program.

How to get rid of WinLock virus?

For removing WinLockers you can use special programs or remove them manually (for not advanced winlockers). For removing virus by yourself use SafeMode with Networking. For automatic removal, you can use HitmanPro.KickStart or Kaspersky RescueDisk.

1. Running operating system in SafeMode with Networking

   

   • Reboot your PC, at the beginning of loading the system press F8;
   • Choose SafeMode with Networking;
   • If operating system runs successfully, then you can download scanner (for example Norton), scan computer and remove the threats;
     If WinLocker runs with your system in safemode, then it is advanced winlocker, that can run even in safemode. We recommend you to use next two methods with special utilities.
2. Using HitmanPro.Kickstart

   

   • First of all, make bootable flash drive with HitmanPro.KickStart, using other PC.
     Download HitmanPro.KickStart for FREE you can here:

    
   Download Hitmanpro.Kickstart
    

   • Insert the flash into USB connector of infected computer and turn on computer;
   • Press F10 or Del in the beginning of loading for joining Boot Menu;
   • Choose Removable Devices as boot device and reboot PC;
   • Here you can see the menu:
     Enter 1 for Bypass Master Boot Record (default);
     Enter 2 if Bypass Master Boot Record doesn’t work;
   • Press Run Windows Normally;
   • Follow instructions and start scan, then remove found threats.
   • Reboot PC, return boot drive to default (Hard-Drive) and all be fine now.
3. Using Kaspersky RescueDisk

   

   • Make bootable flash drive with Kaspersky Rescue Disk or CD;

    
   Download Kaspersky RescueDisk
    

   • Turn on computer and insert Flash Drive or CD into PC;
   • Press F10 or Del in the beginning of loading for running BIOS;
   • Choose Removable Devices or CD-Rom Drive as boot device and reboot PC
   • Press any key when Kaspersky Rescue Disk Logo appears;
   • Follow instructions, until you meet menu with choice:
     1. Run in graphic mode:
     Click on the Gear button, then choose Terminal, type “windowsunlocker” and press Enter;
     2. Run in text mode:
     Press F10, on the bottom side of Midnight Commander type “windowsunlocker” and press Enter;
   • In next menu, choose 1 “Unlock Windows” for cleaning registry, then 0 for exit;
   • WinLocker disappeared now, now we need to kill left files, run full scanner Kaspersky Rescue Disk
   • Reboot PC, return boot drive to default (Hard-Drive) and all be fine now.