Step-by-Step Removal of a Fake Antivirus That Locks Your Screen

A fake antivirus can fill the desktop with alarming warnings, block normal applications, and claim that your files or personal information are in immediate danger. These programs often imitate legitimate security software while pushing victims to pay for a useless license or call a fraudulent support number.

The screen lock may come from installed malware, a malicious browser page, or a scareware process running at startup. Removing a fake antivirus requires calm, deliberate steps. Do not enter payment details, call numbers shown in the warning, or download the “cleanup tool” promoted by the alert.

Recognize the Fake Security Warning

Legitimate antivirus software does not usually demand payment through a pop-up, display a phone number for urgent assistance, or prevent you from accessing essential Windows functions. Warning signs include excessive spelling errors, flashing red banners, fake scan results, and claims that law enforcement or hackers are monitoring the device.

Try pressing Alt + F4 to close the warning. If it returns, press Ctrl + Shift + Esc to open Task Manager. A suspicious process with an unfamiliar name may reveal that the alert is a running program rather than a genuine Windows notification.

If the desktop is unusable, hold the computer’s power button until it shuts down. This is less desirable than a normal shutdown, but it can stop a malicious full-screen process long enough to begin cleanup.

Disconnect the Device From the Internet

Disconnect Wi-Fi from the network menu or unplug the Ethernet cable. This can prevent the fake antivirus from downloading additional files, communicating with its command server, or displaying new payment instructions. It also reduces the risk of the infection spreading through shared network resources.

Do not reconnect immediately after restarting. If the lock screen returns during startup, shut down again and prepare to use Safe Mode. On a second, clean device, download software only from reputable vendors and verify the publisher before transferring anything to the affected computer.

For broader malware removal guidance, the security removal guides on Pc Malware Expert cover threats such as trojans, ransomware, spyware, and browser hijackers.

Start the Computer in Safe Mode

Safe Mode loads Windows with a limited set of drivers and startup programs. Many fake antivirus applications do not launch there, allowing you to remove their files and startup entries.

On Windows 10 or 11, hold Shift while selecting Restart, then choose Troubleshoot, Advanced options, Startup Settings, and Restart. Press 4 for Safe Mode or 5 for Safe Mode with Networking. Use the networking option only when a trusted scanner must be downloaded.

Mac users should shut down the computer, then start it while holding Shift until the login window appears. Apple silicon Macs use a different startup process: hold the power button until startup options appear, select the system volume, hold Shift, and choose “Continue in Safe Mode.” The Mac malware guidance provides platform-specific context for checking suspicious applications and settings.

Symptom	Likely source	First action
Full-screen warning with a phone number	Scareware or browser scam	Disconnect the internet and close the process
Fake scan results after every startup	Malicious startup application	Enter Safe Mode and inspect installed programs
Browser locked to one warning page	Malicious notification or extension	Reset the browser and remove unknown add-ons
Desktop blocked before login	Startup malware or ransomware-like locker	Use recovery options or a trusted rescue environment

Remove Suspicious Programs and Files

While in Safe Mode, open Settings > Apps > Installed apps or Control Panel > Programs and Features. Sort applications by installation date and remove software you do not recognize, especially programs installed shortly before the screen lock appeared. Avoid deleting legitimate Windows components based only on an unfamiliar name.

Open Task Manager and inspect the Startup apps tab. Disable entries associated with the fake antivirus, random names, or unknown publishers. Then check common startup locations, including the Startup folder and suspicious scheduled tasks. If a file refuses to uninstall, do not force-delete system files; use a reputable malware scanner instead.

Run a full scan with a trusted, updated security product. A second-opinion scanner can identify components that the first program misses. Allow the scanner to quarantine detected items, restart the computer, and perform another scan after reconnecting to the internet.

Clean the Browser and Protect Accounts

A browser-based scare page can look identical to an installed infection. Remove unfamiliar extensions, clear recently added notification permissions, and reset the browser if the fake warning keeps returning. Check the homepage, default search engine, and proxy settings for unauthorized changes.

After the device is clean, change passwords for email, banking, social media, and other important accounts from a separate trusted device. Enable multifactor authentication where available, especially for email and financial services. Review account activity for unfamiliar logins and contact a bank immediately if payment information was entered into the scam.

If the fake antivirus installed remote-access software, uninstall it and review Windows accounts for unauthorized users. Businesses should preserve logs and involve an administrator or incident-response professional before making extensive changes.

Keep Fake Antivirus Threats Away

Regular updates, cautious browsing, and reliable backups reduce the chance that a scareware infection will become a larger incident. Keep Windows, macOS, browsers, and security software current, and avoid pirated applications or cracked activation tools, which frequently carry bundled malware.

Use these practical safeguards:

• Download applications from official publishers or trusted app stores.
• Treat urgent security pop-ups and unexpected support numbers as scams.
• Keep offline or cloud backups that can be restored independently.
• Review browser extensions, notification permissions, and startup programs regularly.
• Use a standard user account for everyday work when practical.

If the lock screen remains after Safe Mode cleanup, files are encrypted, or the system shows signs of credential theft, stop using the computer for sensitive activity. Disconnect it, preserve relevant evidence, and seek qualified cybersecurity assistance. Follow the steps above carefully, then run a final full scan before returning the device to normal use.