Overview
A customer in Wandsworth brought in an Acer Aspire 5349 that had become unusable after a fake Metropolitan Police warning took over the screen and demanded payment.
Symptoms
- Full-screen ransom warning on startup
- No normal desktop access
- Customer concern about losing documents
Diagnosis
We identified the issue as the Urausy trojan, often referred to as the “Metropolitan Police virus”. It was configured to lock the session and pressure the user into paying through untraceable methods.
Fix
We removed the malware components, cleaned persistence entries, and verified a normal boot sequence. We then checked file integrity and applied antivirus protection to reduce reinfection risk.
Result
The laptop booted normally again, key user data remained accessible, and the customer avoided paying the scam demand.
Prevention / Tips
Keep antivirus enabled, apply system updates promptly, and never pay on-screen ransom demands from unofficial sources.