Today we will talk again about scammers who earn their money from computer users without leaving their homes. Every 7 computer user has encountered a problem when, when the computer is turned on or restarted, a message (banner) “Your computer is blocked for viewing or copying, replicating something” pops up in full screen. They ask to send an SMS to any operator (MTS, MEGAFON, BEELINE), top up your account, and in return you will supposedly receive an unlock code. If you do not, then all information will be destroyed, the data will be formatted and you will never unlock the computer.
Probably every tenth user laid this money in the hope of reviving a locked computer with a code, thereby filling the electronic wallets of hackers. Remember: never send any SMS, do not put any money on the scammers’ account.
Now I will share with you a solution to defrost your computer if it is already locked.
Method 1 – Edit the registry
Do not be alarmed)), it is very simple and will not take much time. If you don’t want to do this, call us and we will do everything for you. Let’s do everything in order. To access the registry, you need to boot the locked computer in safe mode with command line support, for this, when you turn on the computer, press F8 and select Safe mode with command line support in the boot menu that pops up.
We are waiting for the command line to load and enter regedit.exe in it and press Enter. The registry editor has opened – here our virus blocker has settled. The first place a computer blocker can be:
1. HKEY_CURRENT_USER / Software / Microsoft / Windows / CurrentVersion / Run
here we see a list of startup programs (run together with the operating system), as well as their location on your PC (to then remove them from the disk). All suspicious programs you want to delete (right-click and delete), and remember the path to it (for example: grg54545.exe, bh.exe the path C: / Documents and Settings /; C: / Windows / System , etc.)
2 .HKEY_LOCAL_MACHINE / Software / Microsoft / Windows / CurrentVersion / Run – we repeat the above.
3. HKEY_CURRENT_USER / Software / Microsoft / Windows NT / CurrentVersion / Winlogon-
there should be no Shell and Userinit parameters. If you find them, feel free to delete.
4. HKEY_LOCAL_MACHINE / Software / Microsoft / WindowsNT / CurrentVersion / Winlogon – on the contrary must be present and correspond to these values Userinit – C: Windows / system32 /userinit.exe
Shell – explorer.exe
If this is not the case, then fix it manually. Have you fixed everything? Now close the registry editor and type Explorer.exe on the command line and press enter to start the desktop. We delete the files, the paths of which we remembered, reboot. Your computer is unlocked. Voila! Everything should work.
But he does not always help, because scammers do not “sit still” and invent new ways to block your computer.
2 way to unlock using rollback, system restore
Method 3 – Unlocking your computer using the utilities, links to which in the article How to remove the Windows banner?
