Help with my ramson ware lockout

Question

How do I fix my computer that has been remotely hacked and needs a password to unlock it?

Answer 1

Hi Sandra Cooper,

Thank you for reaching out to Microsoft Q&A forum. I understand how alarming this situation can feel, especially when access to your computer is blocked.

Besides, I see that some steps have already been shared, so I’ll pull them together here and add a few more recommendations:

First, let’s stop any further activity. Please disconnect the PC from the internet right away by turning off Wi‑Fi and unpluging any Ethernet cable. If the screen won’t let you click anything, hold the power button for about five seconds to shut the computer down. This is a standard first step and helps prevent the issue from spreading or getting worse.

Next, please don’t interact with the message on the screen. Don’t pay, don’t call any phone numbers, and don’t scan QR codes. Also avoid entering passwords, card details, or any personal information. These messages are designed to create panic, and paying doesn’t guarantee recovery.

Once the PC is powered off, we’ll start it in a safe, limited mode. Turn the computer on and, as Windows starts to load, hold the power button to force it off. Repeat that power‑on and force‑off cycle about three times. On the next startup, you should see Preparing Automatic Repair. From there, choose Advanced options > Troubleshoot > Startup Settings > Restart, then press F4 for Safe Mode.

While in Safe Mode, run a full security scan using Windows Security. Open Windows Security, go to Virus & threat protection, choose Scan options, and run a Full scan. If anything is found, remove or quarantine it as recommended and let the scan finish completely.

After the scan completes, restart the PC normally and check whether the lock screen is gone. If everything looks normal, you’re all set.

If the lock screen comes back or the system still doesn’t feel right, the safest option is to reset Windows. This removes anything hidden and gives you a clean system again. Go to Settings > Update & Security > Recovery > Reset this PC, choose Keep my files, then follow the prompts. This keeps your personal files but removes apps and fully cleans the system.

Please take it one step at a time and let me know how it goes or if you get stuck at any point. I'm here to help.

---

If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

If your computer has been affected by ransomware, here are some steps you can take to address the issue:

1. Disconnect from the Internet: Immediately disconnect your computer from the internet to prevent further data loss or spread of the ransomware.
2. Identify the Ransomware: If possible, try to determine what type of ransomware has infected your system. This can help you find specific decryption tools or recovery methods.
3. Restore Files: If you have backups of your files, restore them from a backup that was made before the infection occurred. For SharePoint or OneDrive users, you can refer to the appropriate restoration procedures:
   • For SharePoint, see Restore a document library.
   • For OneDrive, see Restore a OneDrive library.
4. Use Antivirus Software: Run a full scan with a reputable antivirus or anti-malware software to remove the ransomware from your system.
5. Contact Support: If you're unable to resolve the issue, consider contacting a professional or your IT department for assistance.
6. Report the Incident: Report the ransomware attack to the appropriate authorities, as they may be able to provide further assistance or guidance.

Remember, paying the ransom does not guarantee that you will regain access to your files, and it may encourage further attacks.

---

References:

• Handling ransomware in Sharepoint Online