Trojan.Ransomlock - How to remove

Trojan.Ransomlock is a nasty piece of ransomware, which can really wreck one’s nerves. This parasite infects the system by exploiting various security holes in your system. Upon infection it drops several entries in the registry, which disable Task Manager, Registry Editor and Safe Mode as a self-defense move. It will then lock the desktop and display the following message in Russian:

To unlock you need to send an SMS with the text 4113558385 to the number 3649

Enter the resulting code:

Trojan.Ransomlock also includes a message at the bottom (falsely) informing the user, that any attempt to reinstall the system will result in the destruction of all data.

The basic idea behind this parasite is that the user has to send an SMS to the given number, thus earning the scammers money for each SMS. Rebooting your system won’t help, because Trojan.Ransomlock runs every time at startup.

Symantec has created a code generator, which will generate a code needed to unlock your system, it can be found here. After neutralizing Trojan.Ransomlock you can safely remove it.

Automatic Malware removal tools

Manual removal