Doctor Web helps users in Russia to get rid of Trojan blocking access to the system

April 10, 2009

Doctor Web informs Internet users about a new Trojan that blocks access to the system and prompts the victim to send a paid SMS in order to receive a registration code to unblock it. Apparently the malicious program has been targeting only users of the Russian segment of the World Wide Web.

The Trojan is spread as a fake video codec. Once installed, it will display a message on Windows start-up informing a user that he needs to enter a registration code to unlock his system. The program was discovered on April 8 and entered the Dr.Web malware classification as Trojan.Winlock.19. The Origins Tracing^TM technology allows Dr.Web anti-viruses to detect new modifications of the Trojan as Trojan.Winlock.origin.

Trojan.Winlock can remove itself in two hours after launching. Users who don’t want to wait that long can use the web-form to enter the text of the suggested SMS and get the unblock code.

If you don't know the exact malware name, try to find screenshot that looks similar.
Attention! Some malware versions look same, so, if the code doesn't suit you, try to find similar image.

You can try to acquire unlock code, if you know exact malware name:

select Trojan.Winlock.49 Trojan.Winlock.54 Trojan.Winlock.56 Trojan.Winlock.63 Trojan.Winlock.67 Trojan.Winlock.68 Trojan.Winlock.69 Trojan.Winlock.70 Trojan.Winlock.69 Trojan.Winlock.74 Trojan.Winlock.76 Trojan.Winlock.78 Trojan.Winlock.80 Trojan.Winlock.81 Trojan.Winlock.86 Trojan.Winlock.87 Trojan.Winlock.88 Trojan.Winlock.89 Trojan.Winlock.91 Trojan.Winlock.92 Trojan.Winlock.94 Trojan.Winlock.96 Trojan.Winlock.97 Trojan.Winlock.99 Trojan.Winlock.98 Trojan.Winlock.100 Trojan.Winlock.101 Trojan.Winlock.102 Trojan.Winlock.112 Trojan.Winlock.105 Trojan.Winlock.106 Trojan.Winlock.107 Trojan.Winlock.110 Trojan.Winlock.111 Trojan.Winlock.117 Trojan.Winlock.119 Trojan.Winlock.135 Trojan.Winlock.160 Trojan.Winlock.163 Trojan.Winlock.166 Trojan.Winlock.169 Trojan.Winlock.172 Trojan.Winlock.184 Trojan.Winlock.185 Trojan.Winlock.188 Trojan.Winlock.190 Trojan.Winlock.191 Trojan.Winlock.202 Trojan.Winlock.213 Trojan.Winlock.214 Trojan.Winlock.215 Trojan.Winlock.222 Trojan.Winlock.224 Trojan.Winlock.227 Trojan.Winlock.231 Trojan.Winlock.236 Trojan.Winlock.237 Trojan.Winlock.253 Trojan.Winlock.254 Trojan.Winlock.257 Trojan.Winlock.258 Trojan.Winlock.265 Trojan.Winlock.273 Trojan.Winlock.276 Trojan.Winlock.277 Trojan.Winlock.285 Trojan.Winlock.287 Trojan.Winlock.291 Trojan.Winlock.299 Trojan.Winlock.302 Trojan.Winlock.313 Trojan.Winlock.322 Trojan.Winlock.328 Trojan.Winlock.329 Trojan.Winlock.334 Trojan.Winlock.346 Trojan.Winlock.374 Trojan.Winlock.406 Trojan.Winlock.407 Trojan.Winlock.415 Trojan.Winlock.425 Trojan.Winlock.430 Trojan.Winlock.436 Trojan.Winlock.467 Trojan.Winlock.468 Trojan.Winlock.482 Trojan.Winlock.491 Trojan.Winlock.499 Trojan.Winlock.558 Trojan.Winlock.565 Trojan.Winlock.592 Trojan.Winlock.649 Trojan.Encoder.54 Trojan.Encoder.56

Or you may try to guess unlock code by selecting a number and a message that Trojan.Winlock asks you to send:

Once again Doctor Web calls on all users to refrain from sending paid messages to virus makers. Dr.Web anti-viruses surely eliminate the threat. If your system has been compromised by the Trojan and you are using an anti-virus from another vendor, use the web-form to receive the code and unblock your system.