Besides the users who ask for help with ransomware removal, you may also see the requests like “FBI locked my computer, what can I do and how to get my files back?”. FBI Lock is not a real computer blockage by the Federal Bureau of Investigation, but a computer virus that shows you fake FBI messages. In this post, you will see the description of this malware, as well as the method of its removal.
What is FBI Lock?
FBI Locker is an example of typical winlocker – virus that shows you a scary banner about the PC blocking for extremist materials checking or keeping the child pornography, and asking for the ransom in Bitcoin. Such a manner is quite similar to ransomware, but the peculiarity is that winlockers are remembered by virus analysts as predecessors of ransomware. After the ransomware appearance in 2014, this type of malware became very rare because of much less profitability and a lot of ways to deal with it without any complicated manipulations1.
However, at the edge of 2021, winlockers appeared in sight, again. They have got some specific features that make them close to classic ransomware, but there are also a lot of moments that distinguish them from the last one type of virus. While ransomware encrypts all your files it can reach, FBI Locker damages only several files on your computer. There are no readme.txt files – you will be informed about the files encryption by the banner which covers your desktop, so you cannot interact with something instead of this banner. Lower, you can see the example of this banner.
Symptoms of FBI Lock virus presence
There is a single and a very bright symptom of FBI Locker presence on your PC. The desktop becomes inactive and gets covered with a banner, so you are not able to make any actions besides interaction with this message. This banner is not able to be skipped with standard methods (Alt+Tab or Ctrl+Alt+Delete combinations), because it implements several important changes after being launched. First, the explorer.exe process is stopped to prevent any tries to open a file/program while the banner is shown. Then, winlogon.exe is suspended to avoid the mentioned combinations usage. Simultaneously, several registry entries are edited, so every time a user tries to log into the system, this banner will appear, again.
