Police virus: what the fake police lock screen is and how to remove it
The Police virus is a screen locker that covers your PC with a fake notice from the police or the FBI and demands a fine paid with a voucher code. It does not encrypt your files and the fine is not real, so do not pay:
- Safe Mode or System Restore
- then a scan
- gets you past it
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
After unlocking, an automatic scan is a quick way to confirm the police locker left nothing behind.
Do it yourself · free Remove Police virus yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Police virus: summary
| Name | Police virus (police ransomware, screen locker) |
|---|---|
| Type | Screen locker, a ransomware subtype that locks the screen and does not encrypt files |
| Symptoms | A full-screen notice in the name of the police that blocks the desktop, Task Manager and the browser, and asks for a fine |
| How to get rid of it | Safe Mode or System Restore, then a full scan; never pay |
| Our check | Desk check on 5 October 2026: official records and Microsoft's entry; no live sample run |
| First seen | 2011 (Europol: May 2011); our report 16 August 2018 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 13 more facts
| Encrypted file extension | None: the locker does not rename or encrypt files |
|---|---|
| Ransom note | Not a file: a full-screen window. The wording differs by version; examples are quoted below |
| Decryptor | Not needed: nothing is encrypted. No More Ransom (nomoreransom.org) lists decryptors if your files do carry a new extension |
| Contact | No e-mail address; payment is made with a voucher code typed into the lock screen |
| Detection names | Microsoft: Ransom:Win32/Reveton.C and Trojan:Win32/Reveton (the Reveton family; the name Police virus covers several families) |
| Distribution | Malicious websites and ads, e-mail attachments, fake codecs, torrents and other downloads |
| Damage | The PC is unusable until the lock is removed; some versions arrived with data-stealing malware |
| Versions | IPA virus; EU Police virus; Metropolitan Police Total Policing virus; FBI virus; Canadian Security Intelligence Service; PCeU virus; Metropolitan virus; Virus Bundespolizei |
| Evidence | 4 write-ups by security sites; details still limited |
| Lock screen claims to be | Police |
| Free decryptor | No free decryptor is known (checked 5 October 2026) |
| Microsoft Defender name | Ransom:Win32/Reveton.C |
| Facts checked | 5 October 2026 |
Desk check on 5 October 2026 against the FBI's 2012 warning, Europol's 2013 release, Microsoft's detection entry and our 2018 screenshots. No live sample was run.
What the Police virus is and how it locks the screen
The Police virus is a screen locker: a program, or sometimes only a web page, that covers everything with a fake notice from the police or another authority and demands a fine. It is a scam first and malware second.
- 1
It reaches the PC
Through a booby-trapped website or ad, an e-mail attachment, or a fake video codec, torrent or other download. Some versions install themselves when a compromised page is merely opened.
- 2
It covers the screen
A full-screen window with a police badge, a flag and your IP address appears and hides the desktop. Task Manager, the browser and other programs are blocked or closed again.
- 3
It accuses you
The text says you watched illegal content or shared pirated files, and that the PC is locked until you pay a fine. The wording changes with the country the PC is in.
- 4
It asks for a voucher
Payment is requested as a prepaid voucher code (Ukash, Paysafecard, MoneyPak or similar), typed into a box on the lock screen. Such codes are hard to trace, which is why the criminals choose them.
- Kind of threat
- Screen locker (police ransomware); it blocks the screen and does not encrypt files
- Earliest records
- 2011: Europol dates the first detections to May 2011, the FBI says Reveton first came to its attention in 2011
- Systems hit
- Windows first; versions for Android and Mac browsers followed (our 2018 report)
- Typical demand
- About 50 to 200 in local currency: 50 pounds, 100 euros or 200 US dollars in the examples we hold
- Payment
- Prepaid vouchers typed into the lock screen
- Who it names
- Police forces and agencies such as the FBI, the Metropolitan Police, PCeU or the Bundespolizei
Our 2018 report called the Police virus "ransomware" because it locks the device and extorts money. That is right in the broad sense, but it matters for what you do next: in most cases your documents and photos are untouched, so the work is getting past the lock, not recovering files.
What we checked for this update
The Police virus is not one website we can open in a clean browser, so there was no live site test. We checked what can be checked, and say what we could not.
Police virus · desk check · 5 October 2026
- Official recordsThe FBI (2012) and Europol (2013) describe the same scheme: a lock in the name of the police, paid with vouchers.
- Microsoft detectionMicrosoft Defender has a detection for the best-known family, Ransom:Win32/Reveton.C, with removal advice.
- Live sampleNot run. We did not run a Police virus sample in 2026, so the screens on this page are from 2012 to 2018.
- Recent reader reportsNone in our comments. The two reader questions we hold are from 2013 (Safe Mode would not start) and 2016 (an Android phone locked by CYBER.POLICE).
- Search interestSmall: about 20 searches a month for the name in the United States.
Scam, usually removable The lock screen is a bluff, and the screen locker can usually be removed without paying. The risk that remains is what came with it: some versions arrived together with password-stealing malware, as the FBI noted for Reveton.
Browser page, program or phone: which lock do you have?
The fix depends on where the lock lives. Work this out first; it takes two minutes.
| What you see | Kind of lock | First thing to try |
|---|---|---|
| The notice is inside a browser window and the rest of Windows works | Browser lock page | Press Alt + F4, or end the browser in Task Manager (Ctrl + Shift + Esc). Do not restore the tabs on the next start |
| The notice covers the whole screen and returns after every restart | Program that starts with Windows | Start in Safe Mode and remove it there (see the plan below) |
| Task Manager and Safe Mode will not open | Locker that blocks tools, or a damaged system | Use the recovery menu: System Restore, or a Microsoft Defender Offline scan from another PC |
| An Android phone shows a police notice that blocks the screen | Android locker app | Safe mode, then remove the app from the device admin list (see below) |
| A Mac browser shows a police warning that will not close | Browser lock page | Force quit the browser and reopen it without restoring windows (see below) |
Problems when uninstalling Police central e crime unit virus from computer... my computer will not allow me to log on in any safe mode, what should I do??
How to get rid of the CYBER.POLICE virus on my Android?? My phone is locked by the CYBER.POLICE virus. I cannot access my files or do anything else with my phone. Rebooting does not help.
Two questions readers sent us. Both are answered on this page: the first in the recovery steps of the plan, the second in the Android section.
Which name will your scanner show?
Microsoft's name for Police virus is Ransom:Win32/Reveton.C.
Defender sorts threats by category first, so the word before the colon tells you what kind of program was found, even if the family name means nothing to you.
Do not search for a removal tool by the detection name alone; fake "removal tools" use the same keywords. How the naming works is explained in our guide to antivirus detection names.
How Police virus behaves
Versions of the Police virus and who they pretend to be
The name "Police virus" covers many look-alike lock screens. Only the badge, the language and the amount change.
| Name people use | Who the screen pretends to be | What our report and the records say |
|---|---|---|
| FBI virus | The FBI and the Department of Justice | Seen from 2012; asks for 200 US dollars through MoneyPak (FBI, 2012) |
| Metropolitan Police Total Policing virus; Metropolitan virus | London's Metropolitan Police | British version with a flag and a voucher box; some copy the PRS for Music name |
| PCeU virus | Police Central e-crime Unit, United Kingdom | Shows your IP address and the Ukash and Paysafecard logos |
| EU Police virus | A European police authority | Listed in our 2018 report; no screenshot kept |
| Virus Bundespolizei | German federal police | Listed in our 2018 report; German-language lock |
| Canadian Security Intelligence Service | Canada's intelligence service | Listed in our 2018 report |
| IPA virus | Not explained in our report | Listed in our 2018 report; we could not confirm which body it copies |
Our 2018 report said the activity started in the United Kingdom and was spreading in Sweden, Poland, Germany, Romania, Denmark and other countries. That list reflects what the lock screens showed at the time: each country got its own language and its own police or authority. Europol's figures from the same period give an idea of the scale: more than 1,200 reported cases in Spain alone.
A short history, from 2011 to our 2018 report
May 2011
The first detections
Europol says the police ransomware was first detected in May 2011. The FBI dates its first notice of Reveton, the best-known family, to 2011 as well. The first versions were British.
Three British versions as our 2018 report showed them: a PRS for Music notice, a Police Central e-crime Unit page and a Metropolitan Police page, each with a voucher box. May 2012
The FBI's Internet Crime Complaint Center warns the public
The IC3 posted a warning in May 2012 and, in August 2012, said it was getting dozens of complaints a day. Reveton installed itself from compromised websites without any click on a file, and some versions showed the victim's own webcam picture on the locked screen.
An FBI-branded lock screen asking for $200 through MoneyPak, shown next to a British and a Finnish version, in our 2018 report. February 2013
Spanish police arrest 11 people
Operation Ransom, led by Spanish police with Europol, arrested 11 people and shut down a network that Europol said affected tens of thousands of computers and made more than a million euros a year. Victims had paid through Ukash, Paysafecard and MoneyPak vouchers.
August 2018
Our own report
We described the lock as active in many countries and on Windows, Android and Mac devices, with ever new badges and languages.
Four versions side by side in our 2018 report: FBI and Department of Justice, PRS for Music, UK Police and Finnish Poliisi. October 2026
This rewrite
We did not run a live sample for this update. The facts here come from our 2018 report, the FBI and Europol records, and Microsoft's detection entry. Treat any screen like those above as a scam.
What the lock screen can really do to you
The accusations are invented. The real risks are paying, and what the same infection brought along.
- High
Paying the fine
Vouchers cannot be traced or reversed, and paying does not unlock the PC. Europol described a network that cashed out victims' vouchers into laundered money, so the payment simply disappears.
- High
Stolen passwords and card numbers
The FBI warned that Reveton was used together with Citadel, a platform that spreads other malware, and that such malware can log keystrokes. Europol says the criminals went on to steal data from the victim's computer. Treat a locked PC as a possible stolen-data case.
- Medium
A PC you cannot use
The lock blocks Task Manager, the browser and sometimes Safe Mode. Without a recovery option you may need another computer or a repair shop.
- Low
Your files
Police lockers did not encrypt documents in the cases we know. If your files do have a new extension, you have a different, file-encrypting ransomware: read our guides for that family instead.
What a locker that also steals data can take
- Passwords saved in browsers
- Card numbers typed on the PC
- Keystrokes
- Webcam picture
- IP address and country
- List of installed programs
Some versions showed the webcam picture on the lock screen; the IP address and country are what the notice shows to make it look official.
The Police virus ransom note
Your computer has been locked.
Illegally downloaded music pieces (pirated) have been located on your computer.
To unlock your computer and to avoid other legal consequences, you are obligated to pay a release fee.
Payable through our payment partner Paysafecard.
Failure to adhere to this request could involve criminal charges and possible imprisonment.
Can Police virus files be decrypted?
Act quickly, because a voucher that is still unused can sometimes be blocked.
- 1
Contact the voucher provider
Tell Paysafecard, MoneyPak's issuer or the shop that sold the code what happened and give them the code. If it has not been spent, they may be able to block it; if it has, the money is gone.
- 2
Change your passwords
Do this from a clean device, not the locked PC. Start with e-mail and online banking, then the sites you stay signed in to.
- 3
Watch your cards and accounts
Check bank statements for payments you did not make. Some versions came with a program that records what you type.
- 4
Report it
Use the reporting table in this guide for your country. A report helps investigators even when the money cannot be recovered.
How to remove Police virus
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove the Police virus lock screen
Your files are not encrypted.
The steps get you past the lock screen first, then remove what starts it.
Step 1: Get past the lock screen
Police virus only blocks the screen, so your files are still there. Start Windows in Safe Mode with Networking from the sign-in screen: Shift + Restart, then Troubleshoot > Advanced options > Startup Settings > Restart > 5.
In Safe Mode the locker stays off, which lets you remove its startup entry, delete its file and run the scan.
The message claims to come from police, but it is fake, and the code it asks you to buy unlocks nothing on Windows 11 or Windows 10.
Full procedure with screenshots: Start Windows or a Mac in Safe Mode On uGetFix
Step 2: Remove it from startup
Whatever Police virus installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
Android phones and Mac browsers
Our 2018 report said the Police virus appears on Android and Mac as well. The Windows plan above does not apply there.
- 1
Android: start in safe mode
Hold the power button until the power-off menu appears, then press and hold Power off until it offers Safe mode and confirm. Safe mode switches off apps you installed, so the locker no longer covers the screen. Menu names vary a little between phone makers.
- 2
Android: remove the locker app
In safe mode open Settings > Apps and look for an app you do not recognise or installed just before the lock. If the uninstall button is grey, open Settings > Security > Device admin apps, switch the locker off there, then uninstall it. Restart the phone normally.
- 3
Mac: close the browser lock
A police warning on a Mac is a web page. Press Option + Command + Esc, select the browser and click Force Quit. Reopen it while holding Shift, so Safari does not restore the page, and do not click anything on the warning.
How to prevent Police virus and the next attack
Every route in is a habit you can change.
Do
- Keep Windows, the browser and your security program updated
- Check the sender and grammar before opening an e-mail attachment
- Download software only from the maker's own site
- Follow the 3-2-1 rule for backups: three copies of your files, on two kinds of storage, with one copy kept offline or off site, so a locked or wiped PC costs you nothing
- Use a VPN on public networks, so the sites you visit and the ad networks see its address instead of yours
Don't
- Open attachments from people or services you do not know
- Install fake video codecs or players to watch a video
- Download cracks, keygens and pirated files from torrent sites
- Click scanner pages that look free and urgent
- Believe any screen that claims the police can see you, and pay
Malicious code often hides in browser extensions, free online scanners and links in e-mails, and it uses security holes in out-of-date programs. Updating closes the holes. A backup means that, in the worst case, you reinstall Windows and copy your files back instead of paying anyone.
Questions about Police virus
How do I open my .docx and .jpg files after the Police virus locked my PC?
Open them as you always did, because the Police virus does not encrypt files. Documents, photos and other files keep their names and extensions such as .docx and .jpg. The lock screen only covers the desktop.
Get past it first, using Safe Mode, System Restore or a second account, and the files open normally. If you can start Windows in Safe Mode, test one file there.
If a file does show a new extension and will not open, a different ransomware is on the PC, and this guide's removal steps still apply but you also need a decryptor from No More Ransom.
Is there a decryptor for the Police virus?
No decryptor is needed, because the Police virus does not encrypt your files. It locks the screen and shows a threat, and nothing on the disk is scrambled. What you need is a removal method:
- Safe Mode
- System Restore
- a Microsoft Defender Offline scan
If your files do carry an odd new extension, that is a different kind of ransomware, and No More Ransom (nomoreransom.org) is the place to check for a free decryptor for it. Do not download tools from unknown pages that promise to unlock the police screen for money.
Should I pay the Police virus ransom?
No, never pay the fine. Paying does not unlock the PC, and the money cannot be recovered. Microsoft's own advice for this threat is not to pay, since there is no guarantee that paying gives access back.
Europol described a network that cashed the vouchers out and laundered the proceeds. The fine is also not real: no police force locks a computer to collect a payment. Remove the lock with the steps in this guide, change your passwords from a clean device and, if you did pay, tell the voucher provider quickly.
Do paid decryption services or data recovery companies work for the Police virus?
You do not need either, because a screen locker leaves files readable. Companies that offer to decrypt or recover your data for a fee are solving a problem you do not have, so be careful with ads that promise to unlock the police screen.
A local computer repair shop can help if you cannot reach Safe Mode, and that is a reasonable use of money. Ask for the work to be described first, and never pay for a voucher-style fine or hand over a remote-access session to a stranger who contacted you.
How did the Police virus get on my PC?
Most often through a booby-trapped website or ad, an e-mail attachment, or a download such as a fake video codec, a torrent or other free software. Our 2018 report named phishing e-mails with macro documents and hacked websites that use security holes.
The FBI said Reveton could install itself when a compromised page was only visited, without any file being opened. The attachments often look safe, so watch for typos and unknown senders. Updated Windows, browser and plug-ins close most of the routes.
Did the Police virus steal my data?
Possibly, but a lock screen alone does not prove it. Our 2018 report found no certain information that the Police virus steals personal data. The FBI, however, wrote that Reveton was used with Citadel, malware that can log what you type, and Europol said the criminals stole data and information from victims' computers.
So treat a locked PC as a possible data-theft case. Change your passwords from another device, watch your bank statements, and scan the PC with Microsoft Defender Offline.
Is the Police virus the same as other ransomware or different?
It is different from file-encrypting ransomware in the way that matters most: it locks the screen instead of scrambling files. Families such as Djvu, LockBit or Phobos rename your files and leave a note, and removing them does not bring the files back.
The Police virus is called ransomware only because it extorts money. Its versions share a method but go by many names:
- FBI virus
- Metropolitan Police virus
- PCeU virus
- Bundespolizei virus
Microsoft detects the best-known family as Reveton.
Will I be arrested or fined for what the lock screen says?
No. The lock screen is a scam, and no authority has contacted you. Police do not freeze computers and collect fines through a pop-up, and they never ask for prepaid vouchers. The accusations of illegal downloads or banned content are shown to everyone, and the screen only repeats your IP address and country to look convincing.
Ignore the demand, remove the lock, and keep a photo of the screen in case you decide to report it. If you are worried, contact your local police on their normal number.
Will Fortect remove Police virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Police virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- FBI: New Internet Scam (Reveton ransomware locks computers, demands payment) (read October 5, 2026)
- Europol: Police dismantle prolific ransomware cybercriminal network (read October 5, 2026)
- Microsoft Security Intelligence: Ransom:Win32/Reveton.C (read October 5, 2026)
- CISA: StopRansomware (read October 5, 2026)
- No More Ransom (read October 5, 2026)