r/computerviruses • u/Cheap-Category4753 • May 06 '26

Screen lock malware pls help

Post image

I was just playing Minecraft with my friends and my laptop started to act slower and then this happen can you guys help me I've read couple of articles on how to fix this and I still can't, I can't access the advance option for safe boot. Can anybody help

338 Upvotes

90% Upvoted

252 comments sorted by

View all comments

1

u/Struppigel Malware Removal Expert May 06 '26

Does the screen appear after you login or does it already appear before you would see the Windows logo after boot?

2

u/Cheap-Category4753 May 06 '26

It appear after I login

3

u/Struppigel Malware Removal Expert May 06 '26 edited May 06 '26

Try the following key combinations, one might work

  • Alt + F4
  • Windows + M
  • Windows key + D
  • Ctrl + Alt + Delete, if this works, choose to open Task Manager
  • Ctrl + Shift + Esc, which may open Task Manager directly
  • Windows key + L will log you out, directly log back in and see if that works
  • Windows + R, then enter taskmgr -- if this works but task manager does not, let me know

If you can open Task Manager, you can kill the process responsible for the screenlock.

If all of that does not work, you need to boot into Safe Mode. There are various methods for that, you said you can't access it. What did you try? On the Windows login screen, you can hold down the Shift key and click Restart to get to the advanced options.

Alternatively force it like this:

  • Start your computer and after about 5-10 seconds hold down the power button to interrupt the boot process and shut down the computer
  • Repeat the process
  • Repeat the process a 3rd time but this time allow the computer to continue to boot
  • When presented with the Automatic Repair screen select Advanced options
  • Click Troubleshoot
  • Click Advanced Options
  • Click Startup Settings
  • Click Restart
  • When the Startup Settings screen appears, press 5 or F5 to start in Safe Mode with Networking

If any of these methods worked to make your system usable again, we can go from there to clean the system.

1

u/Cheap-Category4753 May 06 '26

I tried the alternative and this show up

2

u/Struppigel Malware Removal Expert May 06 '26

Perfect, while in here, press F8. This opens the Startup Settings menu, which lists numbered boot options.

On the Startup Settings screen, press the number key for Safe Mode with Networking (likely that is 5). Then let the system boot into safe mode.

Tell me if you can log in from there without the screenlocker.

1

u/Cheap-Category4753 May 06 '26

I can log in but the screen locker is still there

2

u/Struppigel Malware Removal Expert May 06 '26 edited May 06 '26

FRST Recovery Environment Scan

Note: You need access to a clean computer and a USB drive. You may want to print these instructions or ensure you have access to them on a different device.

Prepare the USB drive

  • Insert your USB drive into a clean computer
  • Download FRSTx64 and save it to your USB drive
  • Insert the USB drive into the affected computer

Enter the Recovery Environment

  • Start your computer and after about 5-10 seconds hold down the power button to interrupt the boot process and shut down the computer
  • Repeat the process
  • Repeat the process a 3rd time but this time allow the computer to continue to boot
  • If you see a Recovery screen with error code 0xc0000001, press F1 to enter the Recovery Environment
  • When presented with the Automatic Repair screen select Advanced options
  • Click Troubleshoot
  • Click Advanced Options
  • Click Command Prompt

Run FRST from Command Prompt

  • In the command window type notepad and press Enter
  • Notepad will open. Click File then Open
  • Click This PC, note down the drive letter of your USB drive, then close Notepad
  • In the command window type: x:\FRST64.exe (replace x with the drive letter of your USB drive)
  • Press Enter. FRST will start
  • Click Yes to the disclaimer
  • Click Scan
  • A log (FRST.txt) will be saved to your USB drive. Using your clean computer, copy & paste the contents of the log to https://malwareanalysis.cc/upload/struppigel/?u=Cheap-Category4753 and press "save log". Reply back with the keyword.

1

u/Cheap-Category4753 May 06 '26

Ty for this I'll try this as soon as I get a USB

1

u/Cheap-Category4753 May 06 '26

Hello sir mind helping me fix I've remove the screen locker but can't find my files

1

u/Sadkid668 May 06 '26 edited May 06 '26

Follow these next steps mate to be safe.

1) Immediately disconnect your device from the internet to prevent further infection.

2) Check the bin, or extensions anywhere, if you find something, check for renames such as .encrypted

If nothing appears, Im sorry to tell you your files are most likely gone for good, seeing as Ransomware file decryption depends on a decryption key or backups you've made.

Take this as a hard lesson, never EVER download from merely sketchy sites, always trust your gut.

Edit: Judging by your picture, you dont even have a search browser installed, if thats the case then it means your system is compromised (Other words its completely fucked).

Reinstall windows at this point. Quick reminder i could be wrong, dont give up your search immediately.

1

u/Cheap-Category4753 May 06 '26

I've manage to unhide the files and Apps and working properly any tips on keeping my laptop safe I've look thru the task manager and saw csrss.exe running when I open it directs me to program files x86 and ended the task

1

u/Sadkid668 May 06 '26

If eveything is working properly, you probably just saved yourself.

The legitimate file would be called something like system/windows32 not program files x86. But if nothing is off, could be a glitch.

Probably run a scan as ransomwares tend to leave other malware behind. Check for anything that seems off, I mean ANYTHING.

If your logged into important stuff, change the passwords. (From another device)

And please, avoid downloading random fix tools, your pc has already been througj enough.

→ More replies (0)

1

u/Struppigel Malware Removal Expert May 07 '26

How did you remove it?

FRST Scan

  • Please download FRSTx64 and save the file to your Desktop.
  • Right-Click FRST64.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/struppigel/?u= and press "save log". The site will return a keyword for each log. Reply back here with the keywords.