Trojan.Ransomlock - How To Remove?


Trojan.Ransomlock is a nasty piece of ransomware, which can really wreck one’s nerves. This parasite infects the system by exploiting various security holes in your system. Upon infection it drops several entries in the registry, which disable Task Manager, Registry Editor and Safe Mode as a self-defense move. It will then lock the desktop and display the following message in Russian:

To unlock you need to send an SMS with the text 4113558385 to the number 3649

Enter the resulting code:

Trojan.Ransomlock also includes a message at the bottom (falsely) informing the user, that any attempt to reinstall the system will result in the destruction of all data.

The basic idea behind this parasite is that the user has to send an SMS to the given number, thus earning the scammers money for each SMS. Rebooting your system won’t help, because Trojan.Ransomlock runs every time at startup.

Symantec has created a code generator, which will generate a code needed to unlock your system, it can be found here. After neutralizing Trojan.Ransomlock you can safely remove it.

Automatic Trojan.Ransomlock removal tools

Note: Reimage trial provides detection of parasites and assists in their removal for free. You can remove detected files, processes and registry entries yourself or purchase a full version.  We might be affiliated with some of these programs. Full information is available in disclosure

Manual removal


Important Note: Although it is possible to manually remove Trojan.Ransomlock, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other tools found on


Trojan.Ransomlock screenshots


About the author

I am an attentive virus researcher. My interests include discussions about deceptive online content and rogue software applications. All of our goal is to minimize the risks that many people encounter during browsing and help them figure out the main hints that might indicate that a program or a website is of a fraudulent nature.

October 14, 2009 05:37, October 14, 2009 05:38

One thought on “Trojan.Ransomlock

1 Comment

Leave a Reply

Your email address will not be published. Required fields are marked *