White Screen FBI virus: what the fake FBI lock is and how to remove it
The White Screen FBI virus is a screen locker that hides your desktop behind a white screen or a fake FBI notice and demands a fine on a prepaid card. The fine is not real and your files are not encrypted, so do not pay:
- start Windows from recovery
- scan
- then change your passwords
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Once you can reach the desktop, a full scan can check for the program behind the FBI lock and anything it brought.
Do it yourself · free Remove White Screen FBI virus yourself 4 steps, about 12 minutes, no software needed.
Start the steps
White Screen FBI virus: summary
| Type | Screen locker, a ransomware subtype that locks the screen and does not encrypt files |
|---|---|
| Risk | Medium: a bluff, but the same infection may carry password-stealing malware |
| Symptoms | A white screen with a cursor, or a full-screen notice in the FBI's name, instead of the sign-in screen or desktop |
| How to get rid of it | Safe Mode with Command Prompt or Microsoft Defender Offline, then a full scan; never pay |
| Our check | Desk check on 5 October 2026 against the FBI and Microsoft; no live sample run |
| First seen | 2011 (FBI, Reveton); our report 26 April 2021 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 13 more facts
| Encrypted file extension | None: files are not encrypted or renamed |
|---|---|
| Ransom note | Not a file: a full-screen window. We quote the notice an FBI victim described |
| Decryptor | Not needed: nothing is encrypted. No More Ransom lists decryptors if your files do carry a new extension |
| Contact | No e-mail address; payment is a prepaid card code typed into the lock screen |
| Detection names | Microsoft: Ransom:Win32/Reveton.C (the best-known family; a white screen version is not confirmed to be Reveton) |
| Name | White Screen FBI virus (FBI virus, screen locker) |
| Distribution | Compromised websites (drive-by), trojans that exploit security holes |
| Damage | The PC is unusable until the lock is removed; some versions arrived with data-stealing malware |
| Evidence | One write-up by a security site; details still limited |
| Lock screen claims to be | FBI |
| Free decryptor | No free decryptor is known (checked 5 October 2026) |
| Microsoft Defender name | Ransom:Win32/Reveton.C |
| Facts checked | 5 October 2026 |
Desk check on 5 October 2026 against the FBI's 2012 story and Microsoft's Reveton.C entry. No live sample was run.
What the White Screen FBI virus is and how it locks the PC
The White Screen FBI virus is a screen locker: it covers the whole display with a notice in the FBI's name, or with a blank white screen, and demands a fine. The fine is a scam and your files are not encrypted.
- 1
It gets onto the PC
The FBI described the best-known version, Reveton, as a drive-by virus: it can install itself when someone only opens a compromised website, with no file to click.
- 2
It takes over the screen
Instead of the sign-in screen or the desktop you see either a notice or a plain white screen with a mouse cursor. Programs you try to start may not open.
- 3
It accuses you
The notice says the FBI found illegal use of downloaded media, pornography or malware spreading on your computer. The FBI's own warning gives these accusations, with fines listed for each.
- 4
It asks for a prepaid card
Payment is requested through a prepaid money service such as MoneyPak, typed in as a code. The FBI's example was $200. Our old guide said $300 and also named Ukash; amounts and services change from version to version.
- Kind of threat
- Screen locker (police ransomware): blocks the screen, does not encrypt files
- Best-known family
- Reveton; Microsoft detects it as Ransom:Win32/Reveton.C (entry published 15 February 2012)
- Typical demand
- $200 through MoneyPak in the FBI's 2012 example; $300 in our old guide
- Who it names
- The FBI, and in the FBI's account the Department of Justice's Computer Crime and Intellectual Property Section
- Extra risk
- Can arrive with Citadel, a platform that delivers other malware
The name "ransomware" in our 2021 report is right only in the broad sense. The lock extorts money, but it does not scramble documents or photos, so the job is getting past the lock, not recovering files.
A short history of the FBI lock screen
2011
First comes to the FBI's attention
The FBI says Reveton, used together with Citadel malware, first came to its attention in 2011.
May 2012
The IC3 issues a warning
The FBI-backed Internet Crime Complaint Center posted a warning on its website in May 2012.
An FBI-branded lock screen from our archive: a black page, the Department of Justice seal, a $200 fine through MoneyPak and a 72-hour threat. It is a black screen, not the white one in this guide. August 2012
Dozens of complaints a day
In an August 2012 story the IC3 said it was getting dozens of complaints every day, that some people had paid the so-called fine and that some variants could turn on the webcam and show the victim's picture on the frozen screen.
The FBI notice next to a British and a Finnish police lock in our archive: one scheme, many badges. None of these is the white screen. April 2021
Our old guide
We published a short note calling it a renewed version of the FBI virus. It had no screenshots, and we did not keep the sample it was based on. Our separate FBI MoneyPak guide shows a full web-page version from the same year.
The FBI MoneyPak lock page from our 2021 FBI MoneyPak guide: an FBI banner, a 72-hour deadline and a code box with store logos. A different guide, shown here as an example of the notice. October 2026
This rewrite
We did not run a sample. The facts come from the FBI, Microsoft and our own 2021 report, and the page says so wherever it matters.
What we checked for this update
There is no website to test for this threat and we did not run a live sample, so this is a desk check. A desk check is not a clean bill of health for any particular PC.
White Screen FBI virus · desk check · 5 October 2026
- Official recordThe FBI's 2012 story describes an FBI-branded lock screen that demands $200 on a MoneyPak card.
- Microsoft detectionMicrosoft Defender has an entry for the Reveton family, Ransom:Win32/Reveton.C, and lists free scanners that detect it.
- Live sampleNot run. Nothing on this page was observed on a real infected PC by us in 2026.
- White screen causeUnconfirmed. We found no source for the idea that a white screen means the locker failed to load.
- Reader reportsNone in our comments. The one reader question we hold is from January 2013.
- Search interestSmall: 90 searches a month each for "pc virus white screen" and "white screen virus" in the United States.
Scam, usually removable The FBI notice is a bluff and the lock can usually be removed without paying. This is a desk check: nothing here is proof that your own PC has only a lock and no other malware.
Which name will your scanner show?
Microsoft's name for White Screen FBI virus is Ransom:Win32/Reveton.C.
Defender sorts threats by category first, so the word before the colon tells you what kind of program was found, even if the family name means nothing to you.
Do not search for a removal tool by the detection name alone; fake "removal tools" use the same keywords. How the naming works is explained in our guide to antivirus detection names.
How White Screen FBI virus behaves
White screen or FBI notice: is it the same infection?
Our 2021 report said it is: whichever screen you see, the same ransomware is on the PC. We could not confirm the cause of a white screen from any source, so read the table as our best reading, not a fact.
| What you see | What our 2021 report says | What we can and cannot confirm |
|---|---|---|
| A white screen with a mouse cursor | The locker failed to load properly | Not confirmed. We found no source that explains a white screen. A white screen can also come from a broken display driver or a damaged sign-in, so check the plan before concluding anything |
| A full-screen notice in the FBI's name | The locker is active and wants a fine | Confirmed by the FBI's 2012 warning and Microsoft's entry: a full-screen window covers all other windows and blocks the desktop |
| A white screen only in the browser, rest of Windows works | Not covered | Probably a web page, not a program: close the browser with Task Manager and do not restore the tabs |
Help me! I am infected with You have 72 hours to pay fine virus!... This scamware blocks the entire system and prevents accessing the Windows Registry Editor, Task Manager, Internet connection and the Start Menu.
A reader's question to our old guide. Task Manager and the registry are blocked, which is why the plan below starts from the recovery menu, not from the desktop.
When you cannot even reach the desktop
Start from outside the locked Windows session. These options come in this order because each needs less of Windows than the one before.
- 1
Try another account
Our old guide noted that other Windows accounts on the PC may still sign in. If one of them has administrator rights, you may be able to start a scan from it.
- 2
Safe Mode with Command Prompt
Open the Windows recovery environment: from a working screen use Settings > System > Recovery > Advanced startup > Restart now. Then choose Troubleshoot > Advanced options > Startup Settings > Restart and pick Safe Mode with Command Prompt. Microsoft lists this option on its Startup Settings page. If Windows will not start at all, Microsoft's recovery environment page lists Automatic Repair as the way in; we did not test it.
- 3
Use a second computer
Download Microsoft's free Windows Defender Offline or Safety Scanner on a clean PC and copy it to a USB drive. Microsoft's Reveton entry says you might need Windows Defender Offline to restore the PC. Do the download on the clean machine, never on the locked one.
Our old guide also suggested hand-editing the registry and deleting the keys of unknown files. We could not confirm that in any source, so we do not give it as a step. Use a scanner, and if that fails, a repair shop.
What the FBI lock can really do to you
The accusations are invented. The risks that are real are paying and what may have arrived with the lock.
- High
Paying the fine
Microsoft does not recommend paying and says there is no guarantee that paying gives access back. Its Reveton entry also says that paying the ransom does not necessarily return the PC to a usable state.
- High
Stolen passwords and card numbers
The FBI warned that even if you unfreeze the PC yourself, the malware may still operate in the background, and that some malware captures user names, passwords and card numbers with keystroke loggers.
- Medium
A PC you cannot use
The lock blocks the desktop. Without a recovery option you may need a second computer or a repair shop.
- Low
Your files
A screen locker does not encrypt documents. If your files do carry a new extension and a note, you have a different ransomware and need a different guide.
The White Screen FBI virus ransom note
Your computer has been locked.
You have violated federal law: illegal use of downloaded media, under-age porn viewing or computer-use negligence.
To unlock the computer, pay a fine of $200 with a MoneyPak order.
If the demand is not met, criminal charges will be filed and the computer stays locked.
Can White Screen FBI virus files be decrypted?
Act quickly. A prepaid code that is not yet spent can sometimes be blocked.
- 1
Call the card provider
Tell the issuer of the prepaid card or the shop that sold it what happened and give them the code. If the code is unspent they may block it; if it is spent, the money is gone.
- 2
Change your passwords
Do it from a clean device, not the locked PC: e-mail and online banking first.
- 3
Watch your accounts
Check statements for payments you did not make, because keystroke-logging malware can run after the lock is gone.
- 4
Report it
The FBI points victims to the IC3 website to file a complaint.
How to remove White Screen FBI virus
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove the White Screen FBI virus lock screen
Your files are not encrypted.
The steps get you past the lock screen first, then remove what starts it.
Step 1: Get past the lock screen
White Screen FBI virus only blocks the screen, so your files are still there. Start Windows in Safe Mode with Networking from the sign-in screen: Shift + Restart, then Troubleshoot > Advanced options > Startup Settings > Restart > 5.
In Safe Mode the locker stays off, which lets you remove its startup entry, delete its file and run the scan.
The message claims to come from FBI, but it is fake, and the code it asks you to buy unlocks nothing on Windows 11 or Windows 10.
Full procedure with screenshots: Start Windows or a Mac in Safe Mode On uGetFix
Step 2: Remove it from startup
Whatever White Screen FBI virus installed usually starts with Windows.
Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Report it and recover your files
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
How to prevent White Screen FBI virus and the next attack
Most of the habits below close the routes named by the FBI and by our old guide.
Do
- Keep Windows, your browser and your security program updated, because drive-by installs rely on security holes
- Download software only from the maker's own site
- Keep backups by the 3-2-1 rule: three copies, on two kinds of storage, one offline or off site, so a locked or wiped PC costs you nothing
- Use a VPN on public networks to hide your address from the sites and ad networks you visit
Don't
- Click ads or links on sites that look compromised
- Open attachments from senders you do not know
- Install fake players or codecs to watch a video
- Believe a screen that says the FBI has found something on your PC and asks for a prepaid card
Questions about White Screen FBI virus
How do I open my .docx and .jpg files after the White Screen FBI virus locked my PC?
Open them as you always did, because this virus does not encrypt files. Documents and photos keep their names and extensions such as .docx and .jpg. The lock only covers the screen.
Get past it first with Safe Mode with Command Prompt or Microsoft Defender Offline, and the files open normally. If a file does show a new extension and will not open, a different, file-encrypting ransomware is on the PC, and this guide's removal steps still apply but you also need a decryptor for that family.
Is there a decryptor for the White Screen FBI virus?
None is needed, because nothing is encrypted. The virus locks the screen and shows a threat, and your files are untouched. What you need is a way past the lock: Safe Mode with Command Prompt or a Microsoft Defender Offline scan, as Microsoft's Reveton entry describes.
If your files do carry a strange new extension, that is a different ransomware, and No More Ransom (nomoreransom.org) is where to look for a free decryptor for it. Do not download tools that promise to unlock the FBI screen for money.
Should I pay the White Screen FBI virus ransom?
No, never pay the fine. Microsoft does not recommend paying, because there is no guarantee that paying gives access back, and the FBI told victims not to pay any money or give personal information.
The FBI does not lock computers or collect fines through a pop-up, and it does not take prepaid cards, so you are not being investigated. The accusations are shown to everyone. If you already paid, call the card issuer at once, change your passwords from a clean device and file a complaint with the IC3.
Do paid decryption services or data recovery companies work for the White Screen FBI virus?
You do not need either, because a screen locker leaves your files readable. Companies and services that offer to decrypt or recover data for a fee are solving a problem you do not have, so be careful with ads that promise to unlock the FBI screen.
A local repair shop can help if you cannot reach Safe Mode, and that is a fair use of money. Ask for the work to be described first, and never give a remote-access session to a stranger who contacted you.
Is the White Screen FBI virus the same as other ransomware or different?
It is different from file-encrypting ransomware in the way that matters most: it locks the screen instead of scrambling files. Families that rename your files and leave a note are not undone by removing them, but this one is.
Our old guide called it a renewed version of the FBI virus; we could not confirm that link. The FBI described Reveton, which Microsoft detects as Ransom:Win32/Reveton.C, but we do not know that a white screen belongs to that family.
Why is my PC showing a white screen and is it a virus?
A white screen can be the virus, but it is not proof. Our old guide said a completely white screen means the ransomware failed to load properly and that the same infection is behind it. We could not find a source that confirms either claim.
A white screen can also come from a damaged sign-in or a graphics driver. Try Safe Mode first: if Windows starts normally there, scan with Microsoft Defender. If an FBI notice shows, it is the lock, and the plan on this page applies.
How did the White Screen FBI virus get on my PC?
Most likely through a compromised website. The FBI said Reveton is drive-by malware that can install itself when you simply open a compromised page, unlike many viruses that need you to open a file. Our old guide said it relies on a trojan that exploits security holes in the system.
Keeping Windows, the browser and your security program updated closes most of these holes. Avoid clicking ads on sites you do not know, and keep a backup so a lock never costs you your files.
Did the White Screen FBI virus steal my passwords or data?
Possibly, and a removed lock does not prove it did not. The FBI wrote that even if you unfreeze the PC yourself, the malware may still run in the background, and that some malware captures user names, passwords and card numbers with keystroke loggers.
Reveton was used with Citadel, which delivers other malware. Change your passwords from another device, check your bank statements and scan the PC with Microsoft Defender Offline before you trust it again.
Will Fortect remove White Screen FBI virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For White Screen FBI virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- FBI: New Internet Scam (Reveton ransomware locks computers, demands payment) (read October 5, 2026)
- Microsoft Security Intelligence: Ransom:Win32/Reveton.C (read October 5, 2026)
- Microsoft Support: Windows startup settings (read October 5, 2026)
- Microsoft Support: Windows recovery environment (read October 5, 2026)
- Adobe: Flash Player End of Life (read October 5, 2026)
- No More Ransom (read October 5, 2026)