Ransomware wallpaper hijack: steps to recover your computer

Coming home from a weekend at Bondi to find your laptop screen filled with a skull-and-crossbones and a Bitcoin address feels deeply violating. The wallpaper has been replaced with a ransom note, and a voice in your head starts rehearsing worst-case scenarios about lost tax records, lost business invoices, and lost photos from that trip to Uluru. This is the unmistakable handiwork of screen-locking ransomware, a malware family that deliberately replaces the desktop background so the message cannot be ignored, even by a user who would never willingly open a ransom note.

A wallpaper-based ransom screen is more than a cosmetic attack. It usually means the malware has disabled Safe Mode, blocked Registry editing tools, and started encrypting files in user folders. Every minute the device stays online gives the operators a chance to reach shared network drives, your myGov cache, or a NAS holding small business backups in Brisbane.

Recognising the ransom wallpaper attack

The classic sign is a high-resolution image filling the entire desktop, often with your username injected to prove the attackers read your profile. Australian victims frequently see threats to "report you to the ATO" or claims that illegal content has been found, language borrowed from fake Australian Federal Police templates used in older lock-screen scams.

Secondary symptoms usually accompany the wallpaper swap. Task Manager may refuse to open, Control Panel shortcuts may vanish, and hidden file extensions may be revealed to make the encrypted filenames look scarier. Previously reliable USB drives may also be flagged as inaccessible as the ransomware tries to spread to removable storage.

Immediate steps to disconnect and isolate

The moment you recognise the takeover, pull the network cable or switch off Wi-Fi. If you connect through a Telstra or Aussie Broadband modem that also serves your household's smart TVs and work laptops, rebooting the modem after disconnecting the infected PC prevents lateral spread across the LAN. Skipping this step is how ransomware hops from a teenager's gaming PC to a parent's home-office machine.

Do not pay the ransom in crypto. The Australian Cyber Security Centre has consistently advised that payment does not guarantee file recovery and may mark you as a willing target for a second attack. Photograph the ransom wallpaper with another device so you have evidence for the report you lodge through the ACSC ReportCyber portal.

Identifying the ransomware strain

Before any cleanup, you need a working theory of which family you are dealing with. The ransom note text, the file extension appended to encrypted documents, and any contact email addresses all give clues. Submitting a sample of the ransom note, never an encrypted personal file, to a reputable identification service speeds up diagnosis.

Ransomware family	Typical file extension	Wallpaper style	Known decryptor availability
STOP/Djvu	.stop, .djvu	Red banner with countdown timer	Partial, via Emsisoft tool
Dharma	.dharma, .cezar	Dark grey background, payment portal link	Limited, variant-specific
Cerber	.cerber	Animated skull with voice-over	No public decryptor
Phobos	.phobos	Police-style threat text	Limited, older builds only
Locky	.locky	Simple ransom message, no animation	No public decryptor

A quick match against this chart can save hours of dead-end research. If you are running macOS, dedicated Mac malware removal advice is worth bookmarking before you begin troubleshooting.

Bypassing the locked desktop

Many wallpaper-locking strains survive a normal restart because they hook the userinit process. Booting into Safe Mode with Networking interrupts most of those hooks. On Windows 10 or 11, hold Shift while clicking Restart from the sign-in screen, then choose Troubleshoot, Advanced Options, Startup Settings, and Restart. When the list appears, press 5 for Safe Mode with Networking.

If Safe Mode itself has been disabled, try booting from a clean USB created with the Microsoft Media Creation Tool on an uninfected machine. Once you reach a working desktop, immediately image the current state before you change anything, even if the data looks encrypted. Forensic investigators occasionally recover partial keys from memory dumps captured at this exact moment.

Removing the malware and cleaning the system

With the machine bootable again, run a full offline scan from a reputable antivirus suite. A second scan with a dedicated on-demand scanner catches anything the resident product missed. While cleaning, also check for companion spyware that piggybacks on ransomware installs, including banking keylogger spyware, a common follow-on infection targeting Commonwealth Bank, NAB, and Westpac logins.

After removal, reset every password you used on the infected machine, especially the one tied to your myGov account and any crypto wallet. Enable two-factor authentication wherever the service supports it, ideally through an authenticator app rather than SMS, since SIM-swap fraud remains a real concern for Australians with high-value accounts.

Decrypting or restoring your files

Public decryptors exist for only a handful of wallpaper-locking strains, so temper your expectations. Check the No More Ransom project for a free tool that matches your identified variant. If a decryptor is unavailable, your next best option is restoring from an offline backup kept on a drive that was never attached to the infected machine.

Cloud backups synced through OneDrive, iCloud, or Google Drive may also hold recoverable versions if versioning was enabled before the attack. Many Sydney and Melbourne households using NBN-connected Synology or QNAP NAS units find that pre-infection snapshots still work, provided the NAS credentials were unique and not stored in the browser on the compromised PC.

Hardening your defences against future attacks

Once the system is clean, plug the holes that let the wallpaper ransomware in. Most infections reach Australian users through malicious attachments in emails pretending to come from Australia Post, Linkt, or energy providers, so tightening email filtering pays off immediately.

Keep browsers lean, since over-permissioned add-ons are an increasingly common entry vector. A practical walkthrough of removing rogue browser extensions helps reset your browser to a trustworthy baseline. Schedule a weekly offline backup, apply operating-system updates within a week of release, and revisit the ACSC's Essential Eight maturity model to track where your security posture actually sits.