Step-by-step cleanup of ransomware that locks your screen with a police message

A locked desktop displaying a police badge, legal warning, or payment demand is a common ransomware tactic. The message may claim that illegal activity was detected and demand a fine through cryptocurrency, gift cards, or another hard-to-trace payment method. These claims are fabricated to create panic and pressure you into acting quickly.

The malware may block normal access to Windows, prevent Task Manager from opening, or launch the warning every time the computer starts. Although the screen looks official, genuine law enforcement agencies do not demand instant payments through anonymous channels or use ransomware-style pop-ups.

Careful isolation and evidence preservation should come before deleting files. The goal is to regain access, remove the malicious startup mechanism, assess whether personal files were encrypted, and use trustworthy recovery options without giving money to criminals.

Disconnect the infected computer

Unplug the Ethernet cable immediately or disable Wi-Fi from the router if the computer cannot be controlled. Disconnecting the device limits communication with the attacker’s server and may prevent additional payloads from downloading. Do not reconnect it simply to search for a decryptor or download a removal tool.

If the warning is visible, photograph or record it with a phone. Capture the ransom note, cryptocurrency address, email contact, file extension, and any stated deadline. This information can help identify the ransomware family and may be useful for reporting the incident.

Avoid calling phone numbers shown in the message. Scammers sometimes use fake “Microsoft” or police support lines to request remote access, payment, or personal information. Never install a remote-access program at their direction.

Try safe access without launching the lock screen

Restart the computer and attempt to enter Windows Recovery Environment. From the sign-in screen, hold Shift while selecting Restart, then choose Troubleshoot, Advanced options, and Startup Settings. Select Safe Mode or Safe Mode with Networking only when downloading a verified security utility is necessary.

If the lock screen appears before Windows loads, Safe Mode may still allow access to the desktop. Open Task Manager with Ctrl + Shift + Esc, inspect unfamiliar processes, and disable suspicious items under Startup apps. Do not terminate essential Windows services based only on an unfamiliar name; verify the file location first.

Run a complete scan with updated, reputable anti-malware software. If Windows remains inaccessible, use a rescue disk created on a clean computer. Bootable scanners can examine the drive before the ransomware starts and are often useful against persistent screen lockers.

Remove persistence and identify the malware

After gaining access, check common startup locations, scheduled tasks, browser extensions, and recently installed programs. A malicious executable may use a random filename and hide inside a user profile folder such as AppData, Temp, or ProgramData. Remove confirmed threats through security software rather than deleting random system files.

Search for ransom notes and encrypted file extensions, but avoid opening suspicious attachments or executable files. Record the malware name and extension before cleanup. For specialized guidance, review this VirLock removal guide, which discusses a ransomware strain that can modify or infect files.

The police-themed screen may be a screen locker with no encryption at all, or it may accompany a file-encrypting infection. If documents, photographs, and archives still open normally, prioritize malware removal and account security. If files have unfamiliar extensions and cannot be opened, preserve a small sample and investigate recovery options before making major changes.

Situation	Immediate action	Recovery outlook
Screen is locked but files open normally	Remove startup malware in Safe Mode and scan offline	Often favorable after cleanup
Files have changed extensions	Isolate the computer and identify the ransomware family	Depends on a working decryptor or backup
Shared drives are affected	Disconnect network storage and other computers	May limit further encryption
Backups are connected or online	Disconnect them without opening files	Recovery may be possible if backups are intact
The ransom note demands payment	Preserve evidence and avoid contact	Payment gives no reliable recovery guarantee

Protect accounts and connected devices

Use a separate, clean device to change passwords for email, banking, cloud storage, and administrator accounts. Start with the email account because attackers can use it to reset other passwords. Enable multifactor authentication wherever available, especially for cloud backup and business services.

Inspect other computers and network-attached storage for unusual file changes. Temporarily disconnect shared folders and backup drives. Ransomware often searches mapped drives and accessible shares, so leaving them connected can spread the damage beyond the original machine.

Check browser sessions, saved passwords, and remote-access tools. Remove software you did not install, review active sign-ins, and revoke unknown sessions from major online accounts. If financial information may have been exposed, contact the bank through its official website or telephone number.

Restore files safely

Do not assume that paying the ransom will produce a working decryption key. Criminals may send defective software, demand additional payments, or disappear after receiving funds. Payment also confirms that the victim is willing to fund future attacks.

Look for offline backups, cloud version history, Windows File History, or system snapshots created before the infection. Restore only after the ransomware has been removed, and scan backup files before copying them back. A clean operating system installation may be safer when the compromise is extensive.

Security researchers sometimes publish free decryptors for specific ransomware families. Check reputable security organizations and current security news updates for verified tools, warnings, and newly identified campaigns. Never trust a decryptor downloaded from a random forum, a pop-up, or the ransom note itself.

Reduce the chance of another lockout

Ransomware commonly arrives through malicious attachments, cracked software, fake browser updates, exposed remote desktop services, and stolen passwords. Keep Windows, browsers, security software, and commonly used applications updated. Remove unsupported programs that no longer receive security patches.

Use standard user accounts for daily work and reserve administrator privileges for controlled installations. Disable unnecessary remote desktop access, secure the router with a unique password, and avoid opening unexpected documents that request macros or unusual permissions.

Use a layered backup approach with at least one copy disconnected from the computer. Test restoration periodically rather than assuming a backup is usable. These practical safeguards can make a frightening police-message scam a contained incident instead of a prolonged data-loss event.

Actions that matter most

• Disconnect the infected computer from networks and shared storage.
• Photograph the ransom note and record file extensions before cleanup.
• Enter Safe Mode or use a bootable rescue scanner from a clean device.
• Change important passwords and revoke suspicious account sessions.
• Restore from verified backups or use a reputable decryptor only after identifying the ransomware.

A fake police warning is designed to make victims surrender control before they investigate. Isolate the system, preserve useful evidence, and proceed with verified security tools and recovery sources. If business systems, sensitive records, or multiple devices are involved, contact a qualified incident-response professional promptly and keep the affected computers disconnected until they are examined.