Doctor Web helps users in Russia to get rid of Trojan blocking access to the system

April 10, 2009

Doctor Web informs Internet users about a new Trojan that blocks access to the system and prompts the victim to send a paid SMS in order to receive a registration code to unblock it. Apparently the malicious program has been targeting only users of the Russian segment of the World Wide Web.

The Trojan is spread as a fake video codec. Once installed, it will display a message on Windows start-up informing a user that he needs to enter a registration code to unlock his system. The program was discovered on April 8 and entered the Dr.Web malware classification as Trojan.Winlock.19. The Origins Tracing^TM technology allows Dr.Web anti-viruses to detect new modifications of the Trojan as Trojan.Winlock.origin.

Trojan.Winlock can remove itself in two hours after launching. Users who don’t want to wait that long can use the web-form to enter the text of the suggested SMS and get the unblock code.

If you don't know the exact malware name, try to find screenshot that looks similar.
Attention! Some malware versions look same, so, if the code doesn't suit you, try to find similar image.

You can try to acquire unlock code, if you know exact malware name:

Or you may try to guess unlock code by selecting a number and a message that Trojan.Winlock asks you to send:

Once again Doctor Web calls on all users to refrain from sending paid messages to virus makers. Dr.Web anti-viruses surely eliminate the threat. If your system has been compromised by the Trojan and you are using an anti-virus from another vendor, use the web-form to receive the code and unblock your system.

Back to articles list