{
	"id": "66d1a140-9a78-49e2-abb0-4b1ad83a1b22",
	"created_at": "2026-04-06T00:21:13.241249Z",
	"updated_at": "2026-04-10T03:20:29.426779Z",
	"deleted_at": null,
	"sha1_hash": "f51ba31abec82bbb99c1b4d61429ddbc23e38f82",
	"title": "Poorly coded Lamdelin Lockscreen Ransomware lets you in using Alt+F4",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 159662,
	"plain_text": "Poorly coded Lamdelin Lockscreen Ransomware lets you in using\r\nAlt+F4\r\nBy AnandKhanse@TWC\r\nPublished: 2017-03-01 · Archived: 2026-04-05 14:44:14 UTC\r\nRansomware, in general, is deadly, but sometimes their authors may not be intelligent enough to make them lethal\r\nenough, and that’s what happened with the new Ransomware kid, Lamdelim.A.\r\nWin32/Lamdelim.A has been detected as locking victim’s PC in exchange for ransom. This lockscreen\r\nransomware doesn’t encrypt files like conventional Ransomware does, but it stops victims from accessing their\r\ndata and demands $200 ransom for the unlock key. However, Lamdelin, at the same time is poorly coded, and\r\nthose infected can break it and enter by simply using Alt+F4.\r\nHow Lamdelin Ransomware spreads\r\nLamdelin may catch you off guard by pretending itself to be a Microsoft file with name as “microsoft.exe” and\r\nusing the icon below.\r\nIf you accidently execute “microsoft.exe” file, your PC screen is locked, and you get a message saying that “Your\r\nWindows has been Banned”.\r\nhttp://news.thewindowsclub.com/poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576/\r\nPage 1 of 3\n\nLamdelin disables Task Manager by setting the following registry entry:\r\nIn subkey: HKU\\Administrator\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\r\nSets value: “DisableTaskMgr”\r\nWith data: “1” (REG_SZ)\r\nThe message asks for $200 ransom, to be paid to “microsoftxyber[@]hackindex.com”.\r\nBut, as mentioned above, you can recover from this attack successfully by following few simple steps.\r\nUnlocking PC when infected with Lamdelin Lock screen Ransomware\r\nThose infected can unlock their PC screen by entering a key that is found in the malware code, or simply closing\r\nthe window by pressing Alt+F4. What puts Lamdelin’s author into a real shame is the fact that the unlock key is\r\nembedded in the malware code: 30264410.\r\nAs soon as you enter 30264410, this threat displays a message – “Windows Successfully Activated”, which you\r\ncan close using the X button:\r\nAs per Microsoft, PC users can also use the following free Microsoft tools to detect and remove this lockscreen\r\nRansomware,\r\n1. Windows Defender for Windows 10 and Windows 8.1, or Microsoft Security Essentials for Windows 7 and\r\nWindows Vista\r\n2. Microsoft Safety Scanner\r\n3. Microsoft Windows Malicious Software Removal Tool.\r\nMicrosoft also recommends turning the Cloud-based Protection “On” as it checks latest malware threats.\r\nhttp://news.thewindowsclub.com/poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576/\r\nPage 2 of 3\n\nAnand Khanse is the Admin of TheWindowsClub.com, a 10-year Microsoft MVP Awardee in Windows (2006-16)\r\n\u0026 a Windows Insider MVP (2016-2022). He enjoys following and reporting Microsoft news and developments in\r\nthe world of Personal Computing.\r\nSource: http://news.thewindowsclub.com/poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576/\r\nhttp://news.thewindowsclub.com/poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"http://news.thewindowsclub.com/poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576/"
	],
	"report_names": [
		"poorly-coded-lamdelin-lockscreen-ransomware-alt-f4-88576"
	],
	"threat_actors": [],
	"ts_created_at": 1775434873,
	"ts_updated_at": 1775791229,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/f51ba31abec82bbb99c1b4d61429ddbc23e38f82.pdf",
		"text": "https://archive.orkl.eu/f51ba31abec82bbb99c1b4d61429ddbc23e38f82.txt",
		"img": "https://archive.orkl.eu/f51ba31abec82bbb99c1b4d61429ddbc23e38f82.jpg"
	}
}