How To Remove “Your computer has been Locked” Tech Support Scam

The “Your computer has been Locked” fake error messages are a social engineering attack that puts your browser on full screen and displays pop-up messages that won’t go away, essentially locking your browser. These fake error messages aim to trick …

The “Your computer has been Locked” fake error messages are a social engineering attack that puts your browser on full screen and displays pop-up messages that won’t go away, essentially locking your browser. These fake error messages aim to trick you into calling an indicated technical support hotline. If you call these scammers, they can offer fake solutions for your “problems” and ask for payment in the form of a one-time fee or subscription to a purported support service.

These “Your computer has been Locked” alerts are nothing more than a scam. Don’t call the number in the pop-ups. Microsoft’s error and warning messages never include a phone number.
Microsoft does not send unsolicited email messages or make unsolicited phone calls to request personal or financial information or fix your computer. Treat all unsolicited phone calls or pop-ups with skepticism. Do not provide any personal information.
Image: Your computer has been Locked - Tech Support Scam
Image: Your computer has been Locked – Tech Support Scam

Your browser may be redirected to the sites that display the “Your computer has been Locked” fake error messages either by malicious advertisements on the sites you visit or adware. This guide was written to help Windows users remove malware from their devices, if your just looking for a way to block the “Your computer has been Locked” redirect on a specific site, then you can use a free browser extension like Adblock.
When it comes to adware, these malicious programs are bundled with other free software that you download off of the Internet. Unfortunately, some free downloads do not adequately disclose that other software will also be installed and you may find that you have installed adware without your knowledge.

The “Your computer has been Locked” fake error messages are shown in such a way as to trick the user into thinking their computer has crashed or that a virus has been detected on the computer. It does this to try and scare the infected user into calling one of the listed numbers in order to receive support. In reality, though, they will only be greeted with people who are trying to sell them unneeded support contracts and services.

The “Your computer has been Locked” fake error messages will have this message:

support.windows.com says:
** Windows Warning Alert **
Malicious Pornographic Spyware/Riskware Detected
Error # 0x80092ee9
Please call us immediately Call Windows
Do not ignore this critical alert.
If you close this page, your computer access will be disabled to prevent further damage to our network.
Your computer has alerted us that it has been infected with a Pornographic Spyware and riskware. The following information is being stolen…

Your computer has been Locked
Your computer with the IP address has been infected by the Trojans — Because System Activation KEY has expired & Your information (for example, passwords, messages, and credit cards) have been stolen. Call Windows to protect your files and identity from further damage.

The scammer will typically attempt to get the victim to allow remote access to their computer. After remote access is gained, the scammer relies on confidence tricks typically involving utilities built into Windows and other software in order to gain the victim’s trust to pay for the supposed “support” services, when the scammer actually steals the victim’s credit card account information.

You should not purchase anything from numbers listed in these “Your computer has been Locked” alerts. Whatever you do, please do not call the phone number for support because it is not Microsoft’s but rather a group of scammers waiting to rob you of hundreds of dollars under false pretenses. Call your credit card provider to reverse the charges, if you have already paid.
The below instructions are for Windows users, however, we also have an Android Guide and a Mac Guide which should help clean up your device.

How To Remove “Your computer has been Locked” Pop-up Scam (Virus Removal Guide)

This malware removal guide may appear overwhelming due to the number of steps and numerous programs that are being used. We have only written it this way to provide clear, detailed, and easy to understand instructions that anyone can use to remove malware for free.
Please perform all the steps in the correct order. If you have any questions or doubt at any point, STOP and ask for our assistance.

To remove the “Your computer has been Locked” pop-ups, follow these steps:


This step is needed if the malicious “Your computer has been Locked” pop-ups will not allow you to close your browser.

  1. Open Task Manager by right-clicking the taskbar and then clicking Task Manager. Alternatively, to start the Windows Task Manager, you can press Ctrl+Alt+Del and click on Task Manager or simply press on Ctrl+Shift+Esc.
    Start Task Manager
  2. Scroll through the list till you see your web browser’s process and left-click on it once so it becomes highlighted. Once you have selected the browser’s process, click on the End Task button as shown in the picture below.
    Close your browser process
  3. Your browser window should now be closed. The next time you open your browser, do not allow the browser to open the last opened page.

STEP 1: Uninstall the malicious programs from Windows

In this first step, we will try to identify and remove any malicious program that might be installed on your computer.

  1. Go to “Programs and Features”.

    Windows 10

    1. On the Start Windows Start button menu, type Control Panel in the search box and select “Control Panel” from the results.
      Go to the Control Panel
    2. When the “Control Panel” window opens click on the “Uninstall a program” option under the “Programs” category.
      Click on Uninstall a Program option - Windows 10

    Windows 8

    Right-click on the Start Windows Start button button in the lower-left corner and select “Programs and Features”. This will take you directly to your list of installed programs.

    Right click on Start and select Programs and Features - Windows 8.1 Help

    • If you can’t find the Programs and Features in the Start menu, type “programs and features” into the search bar at the bottom of the Start window, then click the “Programs and Features” result.
    • If you don’t have a Start button, you are likely running Windows 8 instead of Windows 8.1. Press the Windows key + X to open the menu instead and select “Programs and Features”.

    Windows 7

    1. Click on Start, then select “Control Panel”.Start by clicking on the Start Windows Start button button, then click on “Control Panel”.
      Click on the Windows Start button and select Control Panel - Windows 7 Help

      If you don’t see “Control Panel” here, type control panel into the search bar at the bottom of the Start window, then click the “Control Panel” result.
    2. When the “Control Panel” appears, click on “Uninstall a Program” from the Programs category.
      Select Uninstall a program from Control Panel menu Windows 7 Help
  2. Find the malicious program and uninstall it.

    The “Programs and Features” screen will be displayed with a list of all the programs installed on your PC. Scroll through the list until you find the malicious program, then click to highlight it, then click the “Uninstall” button that appears on the top toolbar.

    Known malicious programs: YeaDesktop, Wajam, 1.0.0.1, DNS Unlocker, Cinema Plus, Price Minus, SalesPlus, New Player, MediaVideosPlayers, Browsers_Apps_Pro, PriceLEess, Pic Enhance, Sm23mS, Salus, Network System Driver, SS8, Save Daily Deals, Word Proser, Desktop Temperature Monitor, CloudScout Parental Control, Savefier, Savepass, HostSecurePlugin, CheckMeUp or HD-V2.2.

    The malicious program may have a different name on your computer. If you cannot find any malicious programs on your computer, you can continue with STEP 2.

    Uninstall malicious programs from Windows

  3. Follow the on-screen prompts to uninstall the program.

    In the next message box, confirm the uninstall process by clicking on Yes, then follow the prompts to uninstall the program.

    Make sure to read all of the prompts carefully, because some malicious programs try to sneak things in hoping that you won’t read closely.

If you are having issues while trying to uninstall a program, you can use Revo Uninstaller Free to completely remove an unwanted program from your PC.

STEP 2: Use Malwarebytes to remove “Your computer has been Locked” adware

Malwarebytes is one of the most popular and most used anti-malware software for Windows, and for good reasons. It is able to destroy many types of malware that other software tends to miss, without costing you absolutely nothing. When it comes to cleaning up an infected device, Malwarebytes has always been free and we recommend it as an essential tool in the fight against malware.

The first time you install Malwarebytes, you’re given a free 14-day trial of the premium edition, which includes preventative tools like real-time scanning and specific protection from ransomware. After two weeks, it automatically reverts to the basic free version that will detect and clean up malware infections only when you run a scan. It is important to note that Malwarebytes will run alongside antivirus software without conflicts.

  1. Download Malwarebytes.

    You can download Malwarebytes by clicking the link below.

    MALWAREBYTES DOWNLOAD LINK
    (The above link will open a new page from where you can download Malwarebytes)
  2. Double-click on the Malwarebytes setup file.

    When Malwarebytes has finished downloading, double-click on the mb3-setup-consumer-x.x.x.xxxx.exe file to install Malwarebytes on your PC. In most cases, downloaded files are saved to the Downloads folder.

    Double-click on mb3-setup to install Malwarebytes Help
    You may be presented with a User Account Control pop-up asking if you want to allow Malwarebytes to make changes to your device. If this happens, you should click “Yes” to continue with the installation.
    Windows asking for permission to run the Malwarebytes installer - Help Guide

  3. Follow the on-screen prompts to install Malwarebytes.

    When the Malwarebytes installation begins, you will see the Malwarebytes Setup Wizard which will guide you through the installation process. To install Malwarebytes on your PC, click on the “Agree and Install” button.
    Malwarebytes Setup Screen - Help Guide
    Malwarebytes is installed on your PC - Help Guide

  4. Click on “Scan Now”.

    Once installed, Malwarebytes will automatically start and update the antivirus database. To perform a system scan, click on the “Scan Now” button.
    Start a scan with Malwarebytes

  5. Wait for the Malwarebytes scan to complete.

    Malwarebytes will now start scanning your computer for adware and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
    Malwarebytes scanning PC for malware - Help Guide

  6. Click on “Quarantine Selected”.

    When the scan has completed, you will be presented with a screen showing the malware infections that Malwarebytes has detected. To remove the malicious programs that Malwarebytes has found, click on the “Quarantine Selected” button.
    Click on the Quarantine Selected button to remove malware

  7. Reboot your computer.

    Malwarebytes will now remove all the malicious files and registry keys that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your computer.
    Malwarebytes requesting to restart computer to complete malware removal process - Help Guide
    When the malware removal process is complete, you can close Malwarebytes and continue with the rest of the instructions.


STEP 3: Use HitmanPro to scan for malware and unwanted programs

HitmanPro is a second opinion scanner that takes a unique cloud-based approach to malware scanning. HitmanPro scans the behavior of active files and also files in locations where malware normally resides for suspicious activity. If it finds a suspicious file that’s not already known, HitmanPro sends it to their clouds to be scanned by two of the best antivirus engines today, which are Bitdefender and Kaspersky.

Although HitmanPro is shareware and costs $24.95 for 1 year on 1 PC, there is actually no limit in scanning. The limitation only kicks in when there is a need to remove or quarantine detected malware by HitmanPro on your system and by then, you can activate the one time 30-days trial to enable the cleanup.

  1. Download HitmanPro.

    You can download HitmanPro by clicking the link below.

    HITMANPRO DOWNLOAD LINK
    (The above link will open a new web page from where you can download HitmanPro)
  2. Install HitmanPro.

    When HitmanPro has finished downloading, double-click on “hitmanpro.exe” (for 32-bit versions of Windows) or “hitmanpro_x64.exe” (for 64-bit versions of Windows) to install this program on your PC. In most cases, downloaded files are saved to the Downloads folder.
    Double-click on the HitmanPro setup file - Help Guide
    You may be presented with a User Account Control pop-up asking if you want to allow HitmanPro to make changes to your device. If this happens, you should click “Yes” to continue with the installation.

    Windows asking for permissions to run the HitmanPro setup file - Help Guide

  3. Follow the on-screen prompts.

    When HitmanPro starts you will be presented with the start screen as shown below. Click on the “Next” button to perform a system scan.
    Click Next to install HitmanProHitmanPro final installer screen

  4. Wait for the HitmanPro scan to complete.

    HitmanPro will now begin to scan your computer for malicious programs. This process will take a few minutes.
    HitmanPro while scanning for malware - Help Guide

  5. Click on “Next”.

    When HitmanPro has finished the scan, it will display a list of all the malware that the program has found. Click on the “Next” button to remove the malicious programs.
    HitmanPro scan summary. Click Next to remove malware - Help Guide

  6. Click on “Activate free license”.

    Click on the “Activate free license” button to begin the free 30 days trial and remove all the malicious files from your PC.
    Activate the free HitmanPro license keyEnter your email to complete the HitmanPro activation - Help Guide
    When the process is complete, you can close HitmanPro and continue with the rest of the instructions.


STEP 4: Double-check for malicious programs with Zemana AntiMalware Free

Zemana AntiMalware is a free popular on-demand antivirus scanner which can detect and remove malware that even the most well-known anti-virus and anti-malware applications fail to find.
While the Malwarebytes and HitmanPro scans are more than enough, we’re recommending Zemana AntiMalware Free to users who still have malware related issues or just want make sure their computer is 100% clean.

  1. Download Zemana AntiMalware.

    You can download Zemana AntiMalware Free by clicking the link below.

    ZEMANA ANTIMALWARE DOWNLOAD LINK
    (The above link will open a new web page from where you can download Zemana AntiMalware)
  2. Double-click on the setup file.

    Double-click on the file named “Zemana.AntiMalware.Setup.exe” to start the installation of Zemana AntiMalware. In most cases, downloaded files are saved to the Downloads folder.
    Image: Double-click on the Zemana AntiMalware to instal it
    You may be presented with a User Account Control dialog asking you if you want to run this file. If this happens, you should click “Yes” to continue with the installation.
    Image: Click Yes to install Zemana AntiMalware

  3. Install Zemana AntiMalware Free.

    Click on the “Next” button to install Zemana AntiMalware on your computer. Follow the on-screen prompts to complete the install process.
    Image: Click Next then follow the on-screen prompts

  4. Click on “Scan Now”.

    When Zemana AntiMalware will start, click on the “Scan Now” button to perform a system scan.
    Image: Click on Scan Now to perform a system scan

  5. Wait for the Zemana AntiMalware scan to complete.

    Zemana AntiMalware will now scan your computer for malicious files. This process can take a few minutes.
    Image: Zemana AntiMalware scanning for malware

  6. Click on “Apply Action”.

    When Zemana AntiMalware has finished it will display a list of all the malware that the program found. Click on the “Apply Action” button to remove the malicious files from your computer.
    Image: Click Apply actions to remove malware found by Zemana AntiMalware

  7. Restart your computer.

    When the malware removal process is complete, Zemana AntiMalware may need to restart your computer. Click on the “Reboot” button to restart your computer.
    Zemana asking to restart PC


STEP 5: Reset the browser settings to remove “Your computer has been Locked” pop-ups

If your PC is being redirected to the Your computer has been Locked site, we will need to reset the web browser settings to their original defaults. This step should be performed only if your issues have not been solved by the previous steps.

Google Chrome

To remove “Your computer has been Locked” fake error messages from Google Chrome, we will need to reset your browser to its default settings. Resetting your browser settings will reset the unwanted changes caused by installing other programs. However, your saved bookmarks and passwords will not be cleared or changed.

  1. Open Chrome’s “Settings” menu.

    Click on Chrome’s main menu button, represented by three horizontal lines. When the drop-down menu appears, select the option labeled “Settings“.
    Google Chrome Settings Menu

  2. At the bottom, click “Advanced”.

    Chrome’s “Settings” should now be displayed in a new tab or window, depending on your configuration. Next, scroll to the bottom of the page and click on the “Advanced” link (as seen in the below example).
    Click on the Advanced button - Google Chrome Help

  3. Under the section “Reset,” click “Reset”.

    Chrome’s advanced settings should now be displayed. Scroll down until the “Reset and clean up” section is visible, as shown in the example below. Next, click on the “Reset settings to their original defaults” button.
    Google Chrome Reset button

  4. Confirm by clicking “Reset”.

    A confirmation dialog should now be displayed, detailing the components that will be restored to their default state should you continue on with the reset process. To complete the restoration process, click on the “Reset Settings” button.
    Click on Reset to restore Google Chrome to its default settings

Mozilla Firefox

To remove “Your computer has been Locked” fake error messages from Firefox, we will need to reset your browser to its default settings. The reset feature fixes many issues by restoring Firefox to its factory default state while saving your essential information like bookmarks, passwords, web form auto-fill information, browsing history and open tabs.

  1. Go to the “Help” menu.

    Click on Firefox’s main menu button, represented by three horizontal lines. When the drop-down menu appears, select the option labeled “Help“.
    Click on the Firefox Menu button then select Help - Firefox Guide

  2. Click “Troubleshooting Information”.

    From the Help menu, click on “Troubleshooting Information“.

    If you’re unable to access the “Help” menu, type about:support in your address bar to bring up the Troubleshooting information page.

    Troubleshooting Information option in Firefox

  3. Click on “Refresh Firefox”

    Click the “Refresh Firefox” button in the upper-right corner of the “Troubleshooting Information” page.
    Refresh Firefox button

  4. Confirm.

    To continue, click on the “Refresh Firefox” button in the new confirmation window that opens.
    Confirm Reset Firefox

  5. Click on “Finish”.

    Firefox will close itself and will revert to its default settings. When it’s done, a window will list the information that was imported. Click on the “Finish“.

Your old Firefox profile will be placed on your desktop in a folder named “Old Firefox Data“. If the reset didn’t fix your problem you can restore some of the information not saved by copying files to the new profile that was created. If you don’t need this folder any longer, you should delete it as it contains sensitive information.

Internet Explorer

To remove “Your computer has been Locked” fake error messages from Internet Explorer, we will need to reset your browser to its default settings. You can reset Internet Explorer settings to return them to the state they were in when Internet Explorer was first installed on your PC.

  1. Go to “Internet Options”.

    Open Internet Explorer, click on the gear icon in the upper right part of your browser, then select “Internet Options“.
    Click on the Gear Icon then select Internet Options - Help Guide

  2. Select the “Advanced” tab, then click “Reset”

    In the “Internet Options” dialog box, select the “Advanced” tab, then click on the “Reset” button.
    In the Advanced tab click on the Reset button - Help Guide

  3. Click on “Reset”.

    In the “Reset Internet Explorer settings” section, select the “Delete personal settings” checkbox, then click on the “Reset” button.
    Click on the Reset button to revert IE to its default settings - Help Guide

  4. Click on “Close”.

    When Internet Explorer has completed its task, click on the “Close” button in the confirmation dialogue box.
    You will now  need to close your browser, and then you can open Internet Explorer again.
    Click on the Close button - Help Guide

Microsoft Edge

To remove “Your computer has been Locked” fake error messages from Microsoft Edge, we will need to reset your browser to its default settings. Starting with Windows 10 Fall Creators Update (version 1709), users can repair or reset the Microsoft Edge settings.

  1. Go to “Apps and Features”.

    Right-click on the Start Windows Start button button in the lower-left corner and select “Apps and Features“. This will take you directly to your list of installed programs.
    Go to Apps and Features in Windows 10

  2. Find Microsoft Edge, then select “Advanced Options”.

    The “App and Features” screen will be displayed with a list of all the programs installed on your PC. Scroll through the list until you find “Microsoft Edge”, click it, and then click on the “Advanced options” link.
    Microsoft Edge Advanced Options

  3. Click on “Reset”.

    The “Advanced Options” screen will now be displayed. Scroll down until the “Reset” section is visible, as shown in the example below. Next, click on the “Reset” button.
    Microsoft Edge Reset Settings


Your computer should now be free of the “Your computer has been Locked” fake error messages. If you are still experiencing problems while trying to remove “Your computer has been Locked” fake error messages from your PC, please do one of the following:

If we have managed to help you, please share this guide to help others.

106 thoughts on “How To Remove “Your computer has been Locked” Tech Support Scam”

  1. your driections and suggestions are soper duper!!!! it took the image disk to get back some of desktop control……i got internet back!!!! i recomment to anyone to feel save working with Stelial…………thank you Stelial

  2. Oook! I just want to thank you so so much, what a nightmare, I fully thought I was going to wake up to police arresting me some time soon for pedofilia. That would so much awkward explaining with all the lezo porn on my computer. (I’m a 26 yr old chick that’s still in the closet!) My deepest appreciation. You guys rock!! ;) :)

  3. Stelian,
    My deepest thanks to you! Your methodical, step-by-step guide was easy to follow and banished the malware. All best to you!

  4. the virus is away. I can’t go to google. There stands you shall not pass. Can you help me please!!!!

  5. Thank you so much, I was so worried when I got this. I was going to pay the money. it works. is there anything anyone can do ti stop these theives. xx

  6. THANKKK YOUUU SOOO MUCCCH! I was so scared when it first popped up onto my screen, I was actually going to pay the money!

  7. Hello Liz,
    If there is no internet connection, you can try scanning in EWS mode (goto Settings -> Advanced -> Early Warning Scoring and check “I am an Expert”).
    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/anonymous-virus/ , on Method 2.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  8. Method 1 worked for me on the first try and the ‘police lock screen’ is gone. Right now I’m throwing everything I’ve got at my system, Hitman Pro, MBAM, Norton Anit-Virus. I feel like I just gave birth to a baby from my head. All should be well now. I need to go to bed for 24hrs. Thank you for honest and precise information and straight-forward help, Stelian. I have a raging headache but things could’ve been far worse. I’ve ffed you on google+. Bless you man!

  9. I love you man. Was visiting US in business and i was downloading some stuff and installed flashplayer when this popped up. I got scared to death,acually bought moneypak 200 $ as this was on my work laptop.. but before i acually paid anything my brain started to work and i searched for this thru my phone and i found this. I have to spend 200 $ on ebay instead now.. but thatss far better. Well thanks man u saved me.

  10. The System Restore method worked for me too, but as others have said it takes time so be patient. Really great to have found a solution. Many thanks as it was real worry. It was obviously a scam as the police would not work like that but when you just can’t get into your own computer and are not a techhy, it’s a real worry. Mind you, how the virus got there in the first place is a mystery as I’ve got fully paid up antivirus software! Anyway, great article and thanks.

  11. Hello Ian,
    If Malwarebytes and HitmanPro scans finished without any infected objects being detected, then you have a clean computer.However if you want to make another check, you can run a scan with the below utilities:
    STEP 1: Run a scan with Eset Online Scanner.

    1. Download ESET Online Scanner utility.
      ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
    2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
    3. Check Yes, I accept the Terms of Use
    4. Click the Start button.
    5. Check Scan archives
    6. Push the Start button.
    7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    8. When the scan completes, push Finish

    STEP 2: Run a scan with Emsisoft Emergency Kit.

    1. Please download the latest official version of Emsisoft Emergency Kit.
      EMSISOFT EMERGENCY KIT DOWNLOAD LINK (This link will open a download page in a new window from where you can download Emsisoft Emergency Kit)
    2. After the download process will finish , you’ll need to unpack EmsisoftEmergencyKit.zip and then double click on EmergencyKitScanner.bat
    3. A pop-up will prompt you to update Emsisoft Emergency Kit , please click the “Yes” button.After the Update process has completed , put the mouse cursor over the “Menu” tab on the left and click-on “Scan PC“.
    4. Select “Smart scan” and click-on the below “SCAN” button.When the scan will be completed , you will be presented with a screen showing you the malware infections that Emsisoft Emergency Kit has detected.Make sure that everything is Checked (ticked) and click on the ‘Quarantine selected objects‘ button.

    Stay safe!

  12. Hi Stelian, thanks heaps for your help! The system restore method worked for me to remove the lock screen, easy instructions for even someone as terrible at this stuff as I am. Only thing is, the MalwareBytes scan never found any infected files for me to delete. Does this mean the infected files are still lurking about somewhere, or am I good to go and the system restore has done the job altogether by itself? Cheers anyway mate, good on you for helping computer noobs like me sort this out!

  13. Thank you so much for this advice. Couldn’t quite believe what I was seeing when this nasty little screen popped up. Especially as they took a photo of me too! Horrible stuff but your instructions did the trick.

  14. Hello Oliver,

    Can you start your computer in Safe mode?If yes, boot your computer in Safe Mode with Command Prompt, and type msconfig in the Command prompt OR if you are using Safe Mode with Networking, in the text box, type msconfig.
    This should start the Windows System Configuration tool. Go to the Start-up tab, and search for any suspicious or unknown entries (random numbers or letter, ctfmon.exe and other suspicious entries) and uncheck them from start-up. Next, start your computer in normal mode and perform a scan with the following tools:

    STEP 1: Run a scan with RogueKiller

    1. Please download the latest official version of RogueKiller.
      RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
    2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
    3. After the scan has completed, press the Delete button to remove any malicious registry keys.

    STEP 2: Run a scan with Emsisoft Emergency Kit.

    1. Please download the latest official version of Emsisoft Emergency Kit.
      EMSISOFT EMERGENCY KIT DOWNLOAD LINK (This link will open a download page in a new window from where you can download Emsisoft Emergency Kit)
    2. After the download process will finish , you’ll need to unpack EmsisoftEmergencyKit.zip and then double click on EmergencyKitScanner.bat
    3. A pop-up will prompt you to update Emsisoft Emergency Kit , please click the “Yes” button.After the Update process has completed , put the mouse cursor over the “Menu” tab on the left and click-on “Scan PC“.
    4. Select “Smart scan” and click-on the below “SCAN” button.When the scan will be completed , you will be presented with a screen showing you the malware infections that Emsisoft Emergency Kit has detected.Make sure that everything is Checked (ticked) and click on the ‘Quarantine selected objects‘ button.
  15. Hi. I’ve done everything you have said and when I turn my computer on and log in the same screen comes up! Any ideas why? Cheers

  16. Thanks a lot, the advice worked a treat and helped me sort out my step-daughters laptop. Thanks very much.

  17. It took a fee tries because everytime i tried doing method one or two, after the log in process it would shut my comp down. I took the batery out and tried oonce more amd method two worked like a charm!! Ty s much

  18. thank you so muched. worked perfectly. started in safe mode and downloaded the file, scanned, restarted and now working. many thanks

  19. Hello Karine,
    If you can start your computer in Safe Mode, then you can either download or transfer Malwarebytes from an USB stick on the infected computer and perform a scan…
    Or your second option, is to boot your computer in Safe Mode with Command Prompt, and type msconfig in the Command prompt OR if you are using Safe Mode with Networking, in the text box, type msconfig.
    This should start the Windows System Configuration tool. Go to the Start-up tab, and search for any suspicious or unknonw entries (random numbers or letter, ctfmon.exe and other suspicious entries) and uncheck them from start-up. Next boot your computer in regular mode and perform a scan with HitmanPro and Malwarebytes as seen on the guide.

  20. Hello Ethan,
    Another possible issue, might be a corrupted driver, can you please try to update or reinstall your Network driver…

  21. Hello Bethany,
    The red x Network icon in your system tray indicates a connection that is not being used. Since your PC is connecting fine to the internet and your home network, more than likely you have more than one possible network connection available for use. Are there any other network adaptors disabled – http://windows.microsoft.com/en-US/windows-vista/Troubleshoot-network-adapter-problems ?
    Another possible issue, might be a corrupted driver, can you please try to update or reinstall your Network driver..

  22. Me again! Um, like another person it says there is no network connection even though I can access the Internet! I followed your steps but when I click view network connections it’s completely blank! Help?! Thankyou

  23. Hello Bethany,
    From a malicious email attachement, a malicious download or a Java exploit, these are the most common infections points.
    Free – Avast 7 Free version or COMODO Internet Security
    Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layered security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
    Also it would very good idea, if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)

  24. Thanks so much!! Fixed my computer up nicely, the first method worked a treat after a couple of attempts, do you know how these viruses get picked up? And what’s the best free antivirus program? Thankyou

  25. I am stuck After step 1 , the safe mode network worked well, but from there i had no internet connection , o i could not download Malwarebytes but now I have no Internet connection and a system recovery is not working! What do I do? Was I suppose to download Malwarebytes after I restart or whilst the computer is still on safe mode? Help please!!

  26. Hello Todd,
    Please try one more time to boot from the HitmanPro USB,pay attention at the booting part and click F11 once your computer starts.
    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  27. Hi Stelian,
    I cannot start Windows successfuly after inserting the HitmanPro Kickstart USB flash drive.
    No option works for me currently (Safe Mode, Safe Mode with Networking, Safe Mode with Command Prompt or even Starting Windows Normally.

    Appreciate your help,
    Todd

  28. Hi, thank you, but unfortunately I already tried that to no avail. It was already enabled. Any other ideas?

  29. Hello Ethan,
    You most liklely have a network adapter disabled.
    Open Network Connections by clicking the Start button , and then clicking Control Panel. In the search box, type adapter, and then, under Network and Sharing Center, click View network connections.
    Right-click the network adapter icon, and then click Enable. If you’re prompted for an administrator password or confirmation, type the password or provide confirmation.

  30. Hello Bishop,
    Please perform a scan with the following tools:
    STEP 1: Run a scan with RogueKiller

    1. Please download the latest official version of RogueKiller.
      RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
    2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
    3. After the scan has completed, press the Delete button to remove any malicious registry keys.
    4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

    STEP 2: Run a scan with Kaspersky Virus Removal Tool
    Click here to download the Kaspersky Virus Removal Tool.

    1. Save it to your desktop.
    2. Double click the setup file to run it.
    3. Follow the onscreen prompts until it is installed
    4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
      • System Memory
      • Hidden startup objects
      • Disk boot sectors
      • Local Disk (C:)
      • Also any other drives (Removable that you may have)
    5. Then click on Actions on the left hand side
    6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
    7. Click on Automatic Scan
    8. Now click the Start Scanning button, to run the scan
    9. After the scan is complete, close the program
  31. I did everything you said successfully and removed the Trojan from my laptop. Multiple scans prove that I am now in the clear, however, my network icon in my tray is showing that my Internet is disconnected, but my Internet works fine (although first startup to my homepage takes longer than usual.) I’ve tried many things but I came get it to stop showing the X. Little worried, is it possible I still have a partial virus?

    Thank you for all your help, hope you can help me further.

  32. Hello Jason,
    If there is no internet connection, you can try scanning in EWS mode (goto Settings -> Advanced -> Early Warning Scoring and check “I am an Expert”).
    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  33. Hello Liam,
    Once you are at the Command prompt,type in the following:
    For Windows XP: C:\windows\system32\restore\rstrui.exe and press Enter
    For Windows Vista/7/8 : C:\windows\system32\rstrui.exe and press Enter
    If for some reason, it won’t go into the System Restore options, boot your computer in Safe Mode with Command Prompt, and type msconfig in the Command prompt. This should start the Windows System Configuration tool. Go to the Start-up tab, and search for any suspicious or unknonw entries (random numbers or letter, ctfmon.exe and other suspicious entries) and uncheck them from start-up. Next boot your computer in regular mode and perform a scan with HitmanPro and Malwarebytes as seen on the guide.

    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  34. Hi, once I am going into Safe Mode with Command Prompt it starts scrolling type before I can imput ‘cd restore’. I know I have to be quick but I am doing this within seconds but doesn’t type anything on the screen.

    Can you help please…?

  35. I was able to access my menu using Safe Mode with Networking. I completed the quick scan and full scan using Malwarebytes. 90 items were removed. Then, I downloaded and ran 64bit Hitmanpro 3. After restart, i still have the locked screen. What can I do?

  36. Great advice. I used System Restore. It took about an hour, so be patient. The hard disk light kept flickering so I stayed with it. On restarting my computer the blocking Ukash page had gone and my desktop was back! Then I followed the link to run Malwarebytes Anti-Malware. Quick scan picked up about 400 infected files which were easy to remove. Sorted! Thanks again.

  37. Hey matey, just downloaded Hitman Pro Kickstart and ran throught all the points successfully until i got to the scan itself when the program said i had no internet connection (although i have a wireless connection up and running) and was ‘searching for Internet connection’ with a countdown timer of 5 minutes next to it. What can i do now now as Hitman won’t take me any further unless i have a connection (even though i do)?

    Jase x

  38. Hello,
    Just follow the instructions from this guide, and you should be able to easily remove this infection…..Start with Step 1:)

  39. Hi this happened to me on a school laptop, if I go the the IT people do you think they will be able to help me? I’m really scared and even considered ringing the police to sort it out, should I ring the police? Thanks heaps
    leigh

  40. Hello,
    No,the police won’t lock down your computer…so this is nothing more than a scam!
    Stay safe!

  41. Thanks! This helped, but I do have a problem though. It could be nothing, but when the message poped up, it had some of my personal info, name, acount, predetermined username, email, age, this worries me, could it be the reap thing. I mean everything it had was common items found on my computer and nothing big like adress or SS but is their a real copies of the virus that is legit? And does this mean anything? Or is it just me. Thanks

  42. Hi
    Just to thank for your clear instructions, sequence and detail which was totally effective in helping me remove and clean up my PC after being hit by the ‘ your computer has been locked’ and you may go to jail malware. A great service very professionally delivered
    Ian
    Dublin

  43. You r really a life saver, came home and this crap was on and almost lost my mind. Thank you so very much…… your awesome!

  44. Hello Pete,
    The HitmanPro should not take more that 10 – 15 minutes….. Try to start another scan, and if you still have problems, you’ll need to create a Kaspersky Rescue CD as seen http://malwaretips.com/blogs/remove-ukash-virus/, on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance

  45. no boot from safe mode or restore point options so I chose option 3 – created hitmanpro to flash and booted from flash drive ok however started to scan and it stopped at “classifying 97%” I left it for over 3 hours and cancelled the scan. Next I attempted a quick scan and that stopped at “classifying99% – can you clarify how long the scan should take as the above instruction video says it should only take a few minutes ………. am I being too impatient??

  46. Thank you so much. Method 2 did the trick for me. Just one to note though, it buggered my Norton up so had to reinstall. Many thanks andy

  47. ______**ANOTHER SOLUTION**______

    This is a solution that worked for me. I had no previous system restore date and Safe Mode with Networking was also being locked.

    In Safe Mode with cmd, I found that it was explorer.exe which triggered the lock.

    So I restarted in Safe Mode with cmd, and before the lock came into effect (there appeared to be a transition lag), I opened up the Task Manager and closed explorer.exe.

    It worked. The lock did not show up, and now I had access to my browser and the internet via Task Manager to install Malwarebytes and rid the computer of the virus. I ran a second scan just to make sure.
    (Just for the record, I actually had opened Internet Explorer before closing explorer.exe, but launching your browser with Task Manager I assume also would work)

    I hope this can be of some help to others. Good luck.

  48. Hello Bram,
    Malwarebytes should have detected the malicious files, nevertheless the HitmanPro scan is free and will only take 5 – 10 minutes…Their is no good reason why you shoudn’t do it! :)
    Stay safe!

  49. Thanks a lot for the helpful solutions above (I had to use the command prompt option asc normal safe mode still gave me the blocked screen). One quick question though, after I scan with Malwarebytes (both quick and full), do you suggest I still run the HitmanPro program? Or is the Malwarebytes enough (it did find an infected file)?

    Kind regards,
    Bram

  50. I have the Police cybercrime virus on my ibm thinkpad computer. I am running windows xp I have done the hitman pro kickstart. I loaded on my desktop computer and then made a usb to load on my infected laptop. It will not recognize my usb. When booting up my usb lights up and looks like it ia available. But I have no access to it during my boot up. What am I missing? Is there something I can do?

  51. Doing the step with command prompt worked for me. Nice job! good advice and I wish the best for you with your shop.

  52. Thank you sooo Much!! It saved my life.. tried method 1 and didnt work but Method 2 worked for me.
    Thank you again as a student it is such a relief i found this blog, because all my neede files are on my laptop.
    Massive thank you!!

  53. Salut Marian,
    Ai incercat vreuna din variantele din articolul asta?Toate sunt usoare de realizat si in functie de ce versiune de virus ai , ar trebui sa rezolve problema ta!
    Sarbatorii fericite!

  54. OMG thank God for you!
    I didn noe what to do but thankfully with this advice, method 2 worked great for me!

    Thank Yu :)

  55. I got over the problem by removing the battery and unplugging the charger.
    I plugged in the charger again and turned on the computer.

    However, although this gets rid of the screen, it erases the history tab for today.
    All other data is left, though.

  56. Hello Matt,
    It looks like you have a more aggressive variant of this virus. Can you please try to format and install back HitmanPro and givinig a try?
    If it doesn’t work, you’ll need to created a Kaspersky Rescue CD as seen in this article, on Method 3.

  57. Step 1, Method 3 + Step 2 = UKASH, down in flames. It also took care of another malware item I didn’t know about. Kudos!

  58. Hey Stelian

    Thanks for the help, but I’m still struggling…

    Methods 1 & 2 are blocked. I’ve got a Kickstart loaded on to a USB and I’m trying method 3. Problem I have is that when I select boot from the flash drive the next screen says to remove disks and hit any key to continue. It won’t continue with the USB in and if I remove it boots to the locked Ukash screen.

    It’s driving me mad. What can I do??

    Thanks again

  59. Succès total et rapide avec la méthode numéro 2. Un gros merci pour avoir partager cette solution. J’imagine qu’elle doit fonctionner pour tous ces types de virus en nous permettant d’avoir accès aux points de restauration du système.

  60. You saved my butt! I thought my computer was getting hacked into.. thanks to you i stopped them! on christmas eve at that!! the best! :)

  61. Mersi frumos Stelian Pilici. Mi-a functionat metoda nr.2. Era cat pe ce sa pun botul la virusul asta ciumeg. mai salvat de o reformatare. Inca odata multumesc mult, sa ai Sarbatori Fericite si Un An Nou Fericit! (Respect efortul si munca ta.)

  62. Thank you, thank you! When my miscreant daughter picked this up at midnight yesterday I thought that was the end of one lappie and the loss of a great deal of university work. I figured I needed to do something from safe mode but had no idea of the instructions to run Restore from a command prompt. You just saved us one unhappy Christmas.

  63. Hello Adissa,
    You should’ve have used just only one of the methods , but even if you used both that’s not a problem.
    If the Malwarebytes scan and HitmanPro came up clean then your computer is good to go!
    Stay safe!

  64. This website helped me a lot but I am still confused. Because when I did the cd restore…and started it on again the screen with the virus (locked computer) didnt appear. And I didnt use a usb to install the scanning tool. I just downloaded it from my actual (infected computer) and i could see any results of that virus …there where 1 or two ..but not called spyware more like GSA i think. So is my computer safe now? has it been removed or not? Thanks again.

  65. I called the police in a panic. Once I got my head together, your website was a blessing. The first time attempted method 1, it didn’t offer a place to type in commands. I tried again and it was a success. Warning “don’t let kids use your laptop and watch freetv!”. Thanks a bunch for the help. Merry Christmas…whhohoo

  66. Thanks a lot. Got infected by virus (Ukash). Used method 1 and I fixed the problem. Your a good man

    Thanks very much.

Leave a Comment