12.09.202027.05.2017

Hello! Today I decided to write an article from a computer. There are more and more scammers on the Internet every day. Therefore, the threat of computer infection also increases. Ransomware viruses that block the desktop and extort money are very common now. It is clear that we will not pay money for this, but we will clean the computer from this infection.

I believe that extortionist banners are already concrete irresponsibility and arrogance. Before we remove this virus, let's look at where it came from in order to be as armed as possible for the future. By the way, banners come across with different content so that you panic more and send money to scammers. Many get lost and send money, but this cannot be done! So where do ransomware banners come from?

Pirated Apps
Naturally, everyone loves a freebie, but have you ever wondered if this is actually a freebie? It turns out that when downloading pirated programs, activators, cracks, tablets, we run the risk of catching a virus program on a computer. Each such download of such files can be fatal and lead to bad consequences. In order not to catch viruses, use official programs.

Download from the global network
Every time you download any files, there is a chance that you can infect your PC. There are many cases when a person downloaded a certain file, and after the reboot a banner appeared. Therefore, I recommend downloading files of any kind from trusted or recommended sites where thousands of visitors download every day.

Flash player update
Spending your time on the Internet, you probably could see somewhere an inscription in the form of a banner "Your player needs to be updated" or "Your player is out of date." Know it's a virus! Of course, if this kind of banner does not lead to the Adobe website.

I have described the most common reasons for a virus to enter your computer. To reduce the likelihood of malicious code getting onto your computer, you need a fresh antivirus, don't forget about it! Now let's consider how to remove banner ransomware from a personal computer. However, once again, never send your money to these scammers. It is very important!!! If you send it, the banner will not go anywhere, and the scammers will get rich thanks to you.

The easiest way is to reinstall the operating system. I already wrote. However, all your installed programs, components, antivirus and settings will need to be reinstalled.

There is another way to remove the ransomware banner without reinstalling the operating system. We will consider it. The first step is to restart your computer. While Windows is loading, press the button F8.

Use the arrows on the keyboard to move the cursor and select the Safe Mode with Command Prompt section.

After that, the computer should start, and you will see the desktop. Next, click Start and type the word regedit in the search box Find programs and files.

After typing and pressing Enter, the Windows Registry will open.

Jul 17

Banner - extortionist, what is it and how to deal with it ?!

Hello dear blog visitors. As always, Dmitry Smirnov is in touch with you, and in this article I want to tell you about what an extortionist banner is and how it can actually be removed easily and simply.

It is a very common type of virus at present. It is very easy to catch them - simple browsing on the Internet can already lead to such a banner. And there is no guarantee that the newest paid antivirus with updated databases will not miss it. However, strictly speaking, ransomware banners are not viruses in the traditional sense of the word. This is not at all an uncontrollably multiplying program code that infects more and more files, modifies their contents, and is transmitted from machine to machine.

Banner extortionist - HIV 2004 - 2010!

In this case, it would be easy to identify it by the distributed signature, which is what antiviruses usually do. But the ransomware banner is not like that, it infects only one, the target machine (from which the infected site was accessed). Next, the banner registers itself in autoload (this is possible in many places, and is done by simply editing the registry - the program code for such an operation is minimal), perhaps before that it moves itself somewhere else (to the system directory of the operating system, renames), and then In the same registry, it blocks the ability to disable itself - it prohibits calling the process manager, registry editor, starting anything at all. The result of these operations is well known - a large banner opens on the whole screen, often of a pornographic nature, or, as an option, informing about the use of an unlicensed version of Windows, etc. The user cannot do anything, everything is blocked, and the banner asks to send an SMS ( naturally, paid) to a certain short number, as if in response a code will come that will allow everything to be unlocked. According to some reports, only in Russia millions of people actually sent such SMS, and most of them, of course, did not receive any code. Of course, there are exceptions, some banners really work “honestly” - the code comes, and even one of the ways to get rid of the banner is to find the most commonly used codes on the Internet and try them out. But this is a very amateurish way, usually doomed to failure. Banner-ransomware is normal software, easily determined in the system “by eye”, and easily removed. It’s just that for an unprepared user, its presence seems something terrible - the computer only allows you to enter the code, and after rebooting with the Reset button, everything repeats over again.

Consider ways to remove ransomware banners

They can be conditionally divided into two groups - requiring a restart of the computer and its subsequent boot from another medium (another HDD, CD, flash drive), and do not require. The first group of methods is more reliable, since a coincidence is always possible when a particularly well-written banner does not allow itself to be removed in some other way, there is simply no such method (the user himself is to blame, and there are simple methods to prevent such situations). In the general case, the treatment is carried out as follows - the computer is rebooted (with the Reset button, usually the banner does not leave any other possibility), loaded from another medium, another operating system.

There are thousands of options here - LiveCD with operating systems based on different versions of Linux (there are such solutions from antivirus manufacturers, for example, the well-known product Dr. Weber, special utility on a disk image downloaded from the site, which itself removes most of the banners), based on the “stripped down” Windows XP Embedded, or simply with a pseudo-graphical interface that only allows you to choose something to run from a number of many utilities useful not only in the fight against viruses (Hiren's Boot CD, etc.). After booting from a separate operating system, you need to scan the infected hard drive, delete the file in which the banner is stored, and return all changes in the registry. Often this is all done by one special utility. You can do without scanning utilities at all, and do everything even faster manually, and go from the back side - first see what the outsider is loading at system startup (in most cases, it is at this stage that the ransomware banner will give itself out, there will be it can be seen that at system startup some file with an incomprehensible name is loaded, or from a directory like C:\Documents and Settings\Default User\Local Settings\Temp\). To do this, you can use different programs to view the contents of the registry files. Such exist even under MS-DOS. One of the most convenient programs of this kind is HiJackThis (under Windows) - it looks at absolutely all the startup paths that are on the system. In the output of this program, there will definitely be a banner - if there is one at all. In fact, the banner extortionist has already passed the virus, like the penentrator!

Well, then everything is simple - the file is deleted (he would not let this be done, being loaded - but in this moment another operating system is loaded, and the malware is not capable of anything), and the computer boots up on a new one, already normal. If there are changes in the registry that prevent the launch of the task manager, etc., they can already be easily returned back, at least by importing *. reg which can be found on the Internet. The launch of the built-in registry editor itself is returned by a file with text like REGEDIT4“DisableRegistryTools”=dword:0

Banner extortionist. The fight against the banner can be done without a special boot disk. Most of these banners make all changes only in the profile of the current user, under which work was carried out at the time of infection. And all that is needed is a simple reload, logging in as a different user (with administrative rights), and finding a banner file that does not load under a different user. If in a particular operating system there is generally only one user with administrative rights, under which work is constantly carried out, and there are no others - this is a gross miscalculation, and this must be corrected immediately. The best practice in general is this - to work constantly under a user who does not have administrative rights. And for everything that requires such rights, use "Run as ..." - to install new software, and other similar tasks. This will protect the operating system not only from ransomware banners, but also from the vast majority of other viruses, and will not require system resources to work. There are even funny situations in which the banner itself, or another malicious program, will request to run as administrator for its installation. There are many other preventive measures that will insure the system against infection by anything - regular archiving of system data, prohibition of autorun of disks, prohibition of editing registry branches responsible for autoload for a permanent user, and many others.
By the way, in a particular case, if just the profile of the only administrator in the system turned out to be infected, but there is at least one other profile without administrative rights, then you can treat it from under it - run the same HiJackThis on behalf of the administrator. So he will be able to search in all branches of the registry without restrictions, and will not cause the banner to launch. If the infected file cannot be deleted from under a specific user, then you need to run with administrative rights (“Run as ...”) any file manager - Total Commander, Far, etc., and delete from it.

A situation is possible when there is nothing at all at hand - no boot disks, nothing at all. Only “naked” Windows, which is already infected. And in this case, a solution to the problem is possible, here it is already necessary to use the flaws in writing the banner virus, which are often allowed. For example, a banner may not completely cover the entire screen. It is possible to go to the desktop, select “My Computer” with the Tab key, manually launch “taskmgr” - and now the task manager is already on the screen, it is already possible to beat a banner from it. Another solution is to launch at least a regular notepad (“notepad”, if you type it blindly, behind a banner), type a few characters there, and then press Ctrl-Alt-Delete and send the system to reboot. Many processes will close (including the banner) - but notepad will ask whether to save the file. By canceling everything at this stage, you can stop the overload, and then look for the banner file. Another original method (requiring, however, preliminary actions) is to use the built-in handler for multiple keystrokes in Windows - “sticky”.
How it works - when you press any button five times, it displays a window about sticky keys, with a request for action. By itself, this sticky handler is not particularly needed, but if its sethc. exe, replace with console file, C:\Windows\System32\cmd. exe, it will be possible to call and command line just by pressing Shift five times, or whatever. The invoked command line will be at the top of the banner, and you can already do a lot from it. If you follow several simple rules, which do not interfere with everyday work at all - always have a backup work profile of another user with administrative rights, and remember the password from it; regularly make system backups (ntbackup.exe); if you have bootable disks with a livecd version of Windows and utilities for fighting viruses and editing registry files, then not only ransomware banners, but also other viruses are unlikely to be able to interrupt your computer for longer than a couple of reboots.

Winlocker (Trojan.Winlock) is a computer virus that blocks access to Windows. After infection, it prompts the user to send an SMS to receive a code that restores the computer's performance. It has many software modifications: from the simplest - "introduced" in the form of an add-on, to the most complex - modifying the boot sector of the hard drive.

A warning! If your computer is locked by a winlocker, under no circumstances should you send SMS or transfer cash to get the OS unlock code. There is no guarantee that it will be sent to you. And if this happens, know that you will give the attackers your hard-earned money for nothing. Don't fall for tricks! Only correct solution in this situation - remove the ransomware virus from the computer.

Self-removal of ransomware banner

This method is applicable to winlockers that do not block booting the OS in safe mode, the registry editor and the command line. Its principle of operation is based on the use of system utilities only (without the use of anti-virus programs).

1. When you see a malicious banner on your monitor, first turn off your Internet connection.

2. Reboot the OS in safe mode:

at the time of the system reboot, hold down the "F8" key until the "Additional boot options" menu appears on the monitor;
use the cursor arrows to select "Safe Mode with Command Line Support" and press "Enter".

Attention! If the PC refuses to boot into safe mode or the command line / system utilities do not start, try removing the winlocker in another way (see below).

3. At the command line, type the command - msconfig, and then press "ENTER".

4. The System Configuration panel will appear on the screen. Open the "Startup" tab in it and carefully review the list of elements for the presence of a winlocker. As a rule, its name contains meaningless alphanumeric combinations ("mc.exe", "3dec23ghfdsk34.exe", etc.) Disable all suspicious files and remember/write down their names.

5. Close the panel and go to the command line.

6. Type the command "regedit" (without quotes) + "ENTER". Upon activation, the Windows Registry Editor will open.

7. In the "Edit" section of the editor's menu, click "Find...". Write the name and extension of the winlocker found in autoload. Start the search with the "Find next ..." button. All entries with the name of the virus must be deleted. Continue scanning with the "F3" key until all partitions have been scanned.

8. Immediately, in the editor, moving along the left column, view the directory:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon.

The "shell" entry should be "explorer.exe"; the "Userinit" entry is "C:\Windows\system32\userinit.exe,".

Otherwise, if malicious modifications are detected, use the "Fix" function (right mouse button - context menu) to set the correct values.

9. Close the editor and go back to the command line.

10. Now you need to remove the banner from the desktop. To do this, enter the command "explorer" in the line (without quotes). When the Windows shell appears, remove all files and shortcuts with unusual names (that you did not install on the system). Most likely, one of them is the banner.

11. Restart Windows in normal mode and make sure you managed to remove the malware:

if the banner has disappeared - connect to the Internet, update the databases of the installed antivirus or use an alternative antivirus product and scan all sections of the hard drive;
if the banner continues to block the OS, use another removal method. It is possible that your PC was hit by a winlocker, which is “fixed” in the system in a slightly different way.

Removal using antivirus utilities

To download utilities that remove winlockers and burn them to a disk, you will need another, uninfected, computer or laptop. Ask a neighbor, friend or friend to use his PC for an hour or two. Stock up on 3-4 blank discs (CD-R or DVD-R).

Advice! If you are reading this article for informational purposes and your computer, thank God, is alive and well, still download the curing utilities discussed in this article and save them on disks or a USB flash drive. The prepared "first aid kit" doubles your chances of defeating the viral banner! Quickly and without unnecessary worries.

1. Go to the official website of the utility developers - antiwinlocker.ru.

2. On home page click the AntiWinLockerLiveCd button.

3. A list of links for downloading program distributions will open in a new browser tab. In the "Disk images for treating infected systems" column, follow the link "Download AntiWinLockerLiveCd image" with the number of the older (newer) version (for example, 4.1.3).

4. Download the ISO image to your computer.

5. Burn it to DVD-R/CD-R using ImgBurn or Nero using the "Burn disc image" function. The ISO image must be written in unpacked form in order to get a bootable disk.

6. Insert the disc with AntiWinLocker into the PC where the banner is rampant. Restart the OS and go into the BIOS (find out the hotkey for entering in relation to your computer; the options are "Del", "F7"). Install the boot not from the hard drive (system partition C), but from the DVD drive.

7. Restart your PC again. If you did everything correctly - correctly burned the image to disk, changed the boot setting in BIOS - the AntiWinLockerLiveCd utility menu will appear on the monitor.

8. To automatically remove the ransomware virus from your computer, click the "START" button. And that's it! No other actions are needed - destruction in one click.

9. At the end of the removal procedure, the utility will provide a report on the work done (which services and files it unblocked and cured).

10. Close the utility. When you reboot the system, go back to the BIOS and specify the boot from the hard drive. Start the OS in normal mode, check its performance.

WindowsUnlocker (Kaspersky Lab)

1. Open the sms.kaspersky.ru page (Kaspersky Lab's official website) in your browser.

2. Click the "Download WindowsUnlocker" button (located under the inscription "How to remove the banner").

3. Wait until the boot disk image of Kaspersky Rescue Disk with the WindowsUnlocker utility is downloaded to the computer.

4. Burn the ISO image in the same way as the AntiWinLockerLiveCd utility - make a bootable disk.

5. Set the BIOS of the locked PC to boot from the DVD drive. Insert the Kaspersky Rescue Disk LiveCD and reboot the system.

6. To launch the utility, press any key, and then use the cursor arrows to select the interface language ("Russian") and press "ENTER".

7. Read the terms of the agreement and press the key "1" (I agree).

8. When the desktop of Kaspersky Rescue Disk appears on the screen, click on the leftmost icon in the taskbar (the letter "K" on a blue background) to open the disk menu.

9. Select "Terminal".

10. In the terminal window (root:bash) next to the "kavrescue ~ #" prompt, type "windowsunlocker" (without quotes) and activate the directive with the "ENTER" key.

11. The utility menu will be displayed. Press "1" (Unlock Windows).

12. After unlocking, close the terminal.

13. Access to the OS is already there, but the virus is still free. To destroy it, do the following:

connect the internet;
launch the "Kaspersky Rescue Disk" shortcut on the desktop;
update antivirus signature databases;
select the objects to be checked (it is desirable to check all elements of the list);
with the left mouse button, activate the "Perform object check" function;
if a ransomware virus is detected from the suggested actions, select "Delete".

14. After treatment, in the main menu of the disc, click "Turn off". At the time of restarting the OS, go to BIOS and set the boot from the HDD (hard drive). Save your settings and boot Windows normally.

Dr.Web Computer Unlock Service

This method is to try to force the winlocker to self-destruct. That is, give him what he requires - an unlock code. Naturally, you don't have to spend money to get it.

1. Copy the wallet or phone number that the attackers left on the banner to buy the unlock code.

2. Log in from another "healthy" computer to the Dr.Web unblocking service - drweb.com/xperf/unlocker/.

3. Enter the rewritten number in the field and click the "Search Codes" button. The service will automatically select the unlock code according to your request.

4. Rewrite/copy all codes displayed in the search results.

Attention! If these are not found in the database, use the Dr.Web recommendation to remove the winlocker yourself (follow the link posted under the message "Unfortunately, at your request ...").

5. On the infected computer, enter the unlock code provided by the Dr.Web service into the "interface" of the banner.

6. In case of self-destruction of the virus, update the antivirus and scan all sections of the hard disk.

A warning! Sometimes the banner does not respond to entering the code. In this case, you need to use another method of removal.

Removing the MBR.Lock banner

MBR.Lock is one of the most dangerous winlockers. Modifies the data and code of the master boot record of a hard disk. Many users, not knowing how to remove this type of ransomware banner, begin to reinstall Windows, in the hope that after this procedure their PC will “recover”. But, alas, this does not happen - the virus continues to block the OS.

To get rid of the MBR.Lock ransomware, follow these steps (Windows 7 option):
1. Insert the Windows installation disk (any version, assembly will do).

2. Go to the BIOS of the computer (find out the hot key to enter the BIOS in technical description your PC). In the First Boot Device setting, set "Cdrom" (boot from a DVD drive).

3. After the system restarts, the Windows 7 installation disk will boot. Select the type of your system (32/64 bits), interface language and click the "Next" button.

4. At the bottom of the screen, under the "Install" option, click "System Restore".

5. In the "System Recovery Options" panel, leave everything as it is and click "Next" again.

6. Select the "Command Line" option from the Tools menu.

7. At the command prompt, type the command - bootrec / fixmbr, and then press "Enter". The system utility will overwrite the boot record and thus destroy the malicious code.

8. Close the command line, and click "Restart".

9. Scan your PC for viruses with Dr.Web CureIt! or Virus Removal Tool (Kaspersky).

It is worth noting that there are other ways to treat a computer from a winlocker. The more tools you have in your arsenal to combat this infection, the better. In general, as they say, God saves the safe - do not tempt fate: do not go to dubious sites and do not install software from unknown manufacturers.

Let ransomware banners bypass your PC. Good luck!

Winlocker Trojans are a type of malware that, by blocking access to the desktop, extorts money from the user - supposedly if he transfers the required amount to the attacker's account, he will receive an unlock code.

If once you turn on the PC you see instead of the desktop:

Or something else in the same spirit - with threatening inscriptions, and sometimes with obscene pictures, do not rush to accuse your loved ones of all sins.

They, and maybe you yourself, fell victim to the trojan.winlock ransomware.

How do ransomware blockers get on a computer?

Most often, blockers get on the computer in the following ways:

through hacked programs, as well as tools for hacking paid software (cracks, keygens, etc.);
are downloaded via links from messages in social networks, sent supposedly by acquaintances, but in fact - by intruders from hacked pages;
downloaded from phishing web resources that imitate well-known sites, but in fact created specifically for the spread of viruses;
come by e-mail in the form of attachments accompanying letters of intriguing content: “you were sued ...”, “you were photographed at the crime scene”, “you won a million”, and the like.

Attention! Pornographic banners are not always downloaded from porn sites. Can and with the most ordinary.

Another type of ransomware is distributed in the same way - browser blockers. For example, like this:

They demand money for access to web browsing through a browser.

How to remove the banner "Windows is blocked" and the like?

When the desktop is locked, when a virus banner prevents the launch of any programs on the computer, you can do the following:

go into safe mode with command line support, start the registry editor and delete the banner's autorun keys.
boot from a Live CD (“live” disk), for example, ERD commander, and remove the banner from the computer both through the registry (autorun keys) and through the explorer (files).
scan the system from a boot disk with an antivirus, such as Dr.Web LiveDisk or Kaspersky Rescue Disk 10.

Method 1: Removing the winlocker from safe mode with console support.

So, how to remove a banner from a computer via the command line?

On machines with Windows XP and 7, before the system starts, you need to quickly press the F8 key and select the marked item from the menu (in Windows 8 \ 8.1 there is no such menu, so you have to boot from the installation disk and run the command line from there).

Instead of a desktop, a console will open in front of you. To launch the registry editor, enter the command in it regedit and press Enter.

Next, open the registry editor, find virus entries in it and fix it.

Most often, ransomware banners are registered in sections:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon- here they change the values of the Shell, Userinit and Uihost parameters (the last parameter is only in Windows XP). You need to fix them to normal:

shell=explorer.exe
Userinit = C:\WINDOWS\system32\userinit.exe, (C: is the letter of the system partition. If Windows is on drive D, the path to Userinit will start with D:)
Uihost=LogonUI.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows- see AppInit_DLLs parameter. Normally, it may be absent or have an empty value.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run- here the ransomware creates a new parameter with the value as the path to the blocker file. The parameter name can be a string of letters, such as dkfjghk. It must be removed completely.

The same goes for the following sections:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

To fix registry keys, right-click on the setting, select Edit, enter a new value, and click OK.

After that, restart your computer in normal mode and do an antivirus scan. It will remove all ransomware files from your hard drive.

Method 2. Removing a winlocker using ERD Commander.

ERD commander contains a large set of tools for Windows Recovery, including when hit by blocker trojans.

Using the ERDregedit registry editor built into it, you can do the same operations that we described above.

ERD commander will be indispensable if Windows is blocked in all modes. Copies of it are distributed illegally, but they are easy to find on the net.

ERD commander sets for all versions of Windows are called MSDaRT (Microsoft Diagnostic & Recavery Toolset) boot disks, they come in ISO format, which is convenient for burning to DVD or transferring to a USB flash drive.

It is equally effective to remove banners from a computer using both Dr.Web and Kaspersky discs.

How to protect your computer from blockers?

Install a reliable antivirus and keep it active at all times.
Check all files downloaded from the Internet for security before launching.
Don't click on unknown links.
Do not open email attachments, especially those that come in letters with intriguing text. Even from your friends.
Keep track of what websites your children visit. Use parental controls.
If possible, do not use pirated software - many paid programs can be replaced with safe free ones.

Greetings!
In connection with the mass distribution of gadgets and devices that run the Android operating system, the question of protecting them and getting rid of malware is becoming more and more urgent. software.

Malicious software is divided into categories, each of which has its own properties and characteristics. In this article, we will analyze the most common categories of malware for the Android operating system and consider the most effective methods to combat this evil.

Trojan removal

The most popular type of malware is trojan. His destructive activity consists in collecting and sending confidential information to criminals, ranging from personal correspondence in instant messengers to bank card details when making a payment. In addition, this malware can covertly send SMS to short paid numbers, which causes financial damage to the owner of the device.

To get rid of malware, follow the instructions:
1) Install from Play market one of the popular antivirus solutions for android: AVG, Kaspersky, Dr. Web and scan your system for viruses.

2) After the scan is complete, delete all found suspicious files.
As a rule, voiced actions are enough to clean android system from trojans.

Ad virus removal

Applications that add ads are also quite common. Unlike Trojans, their malicious action is to add ads to the system interface and browser. As a result, the responsiveness of the interface slows down and the traffic consumption increases!
The most common way this type of malware enters the system is through the installation of pseudo-free games.
Most effective way can be called the installation of the AdAvay application, which will block access to addresses from which advertising content is downloaded.
However, this method is associated with some difficulties, namely the need to obtain root access on the device being installed (the application does not work without it) and installation of the application from the site, for which in the device settings you need to check the box unknown sources, which is located in Settings -> Security.
If these difficulties do not stop you, then as a result you will practically completely get rid of from annoying pop-up and flickering ads in apps as well as the browser.

Removing the ransomware banner

This category of malware blocks access to the gadget's interface and requires the owner to transfer money to unlock it. Never transfer money to scammers. there is no guarantee that after payment you will return access to your gadget.
If you find this malware, do the following:

1) Turn off the device and remove the SIM card.

2) Turn on the device and as quickly as possible (before the blocker banner appears) go to Settings -> For developers and check the box next to USB Debugging, and then select the suspicious app from the menu. And finally, check the box next to the item that has become active Wait for the debugger to connect.

If the menu Select application to debug you have a lot of applications displayed, and you find it difficult to identify a malicious one, then its name with a very high degree of probability can be underlined in Settings –> Security –> Device administrators.
To increase its own privileges and make it harder to remove, the malware usually adds itself to this list.

The menu section may also be missing. For developers. To activate it, you need to go to the menu About Tablet PC and click on the item several times in a row Build number.
You may have to reboot the device several times in order to have time to do the necessary manipulations.

3) After the manipulations, the system interface will be unlocked and you only have to Settings –> Security –> Device administrators uncheck the malicious application. This must be done in order to remove privileges that block the removal of a malicious application by regular system tools.

4) Remove the malicious application using regular means, to do this, follow the Settings -> Applications -> <имя приложения>

Summary

By following these instructions, you can quickly and effortlessly deal with the most diverse types of malware that are found on smartphones and tablets running on the Android operating system.