Interpol Department of Cybercrime virus - How to remove?


Interpol Department of Cybercrime virus is an annoying Ransomware locking people from their PCs. It belongs to Police Virus ransomwares aka impersonates law institutions (in this case, Interpol). This is done to force people into paying a fine for up to 200 USD for supposedly broken law using pre-paid cards like Ukash, PaysafeCard and (in USA) Moneypak. Duo to the way pre-paid cards operate, it is impossible to get money paid for Interpol department of Cybercrime ransomware back. Thus it is better to avoid this parasite completely or get rid of it using other ways. Some versions of these ransomwares are really badly written and call themselves “Interpol department of Cibercrime” instead of Cybercrime. This shows lack of attention to details.
Interpol department of Cybercrime virus is distributed using exploit pages, spam messages or trojans hidden in files on various shady sites. Typically, these files are recognized by antiviruses quite soon and PCs running AVs are protected from such scams. However, sometimes your protection fails and the ransomware blocks you completely. department of Cybercrime malware is not too original and will display about the same text to scare you:

Your PC is blocked due to at least one of the reasons specified below.
You have been violating Copyright and Related rights law (Video, Music, Software) and illegally using or distributing copyrighted content, thus infringing Article 128 of the Criminal Code of World Department of Cybercrime.
Article 128 of the Criminal Code provides a fine of 2 to 5 hundred minimal wages or a deprivation of liberty for 2 to 8 years.

This is obvious, that there is no global Criminal Code that is applicable Worldwide. And generally speaking, police would contact you personally if you would have broken any law. Thus never pay for law institutions using pre-paid cards or you will fund development of future versions of Interpol Department of Cybercrime virus and similar ones.
To remove Interpol Department of Cybercrime ransomware, follow these instructions
1. Reboot and press F8. Choose Safe mode
2a. If malware does not load, run MSConfig and disable all startup entries. Reboot normally. Continue to step 5.
3b . If Malware does load, reboot into safe mode with command prompt
4. Run Regedit and search for Winlogon
5. There will be shell variable under correct Winlogon, which references either explorer.exe (leave untouched), explorer.exe and something else (leave explorer.exe), Something from application data (change to explorer.exe) or something else (leave untouched).
6. Once you find the Interpol Department of Cybercrime virus file name (something from Application Data), search for it in registry and remove.
7. Close Regedit, enter Shutdown -r -t 0.
8. Important: Scan with anti-malware programs like Spyhunter or Malwarebytes Anti-Malware to confirm that your PC is fully cleaned up and no additional infection is present.
If something fails ask your questions bellow, or consult support on +1-888-334-2444.

Video guide for Interpol Departament of Cybercrime virus


Automatic Interpol Department of Cybercrime virus removal tools


Other tools

  0   0
  0   0
    Malwarebytes Anti-Malware
  Download Reimage for interpol virus detectionNote: Reimage trial provides detection of parasite like interpol virus and assists in its removal for free. You can remove detected files, processes and registry entries yourself or purchase a full version.
  We might be affiliated with some of these programs. Full information is available in disclosure

Manual Interpol Department of Cybercrime virus removal


Important Note: Although it is possible to manually remove interpol virus, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other tools found on


It is impossible to list all file names and locations of modern parasites. You can identify remaining parasites, other interpol virus infected files and get help in interpol virus removal by using Reimage scanner. 


Interpol Department of Cybercrime virus screenshots

September 26th, 2016 15:37, September 26th, 2016 15:37
Fill this form to subscribe to our newsletter

20 thoughts on “Interpol Department of Cybercrime virus

  1. Freddie adams

    Iv got the winlogon open but there isnt “shell” in it what do i do?

  2. Sally-anne

    I enter safe mode with command prompt but then it asks which operating system to start – Microsoft windows Xp professional or that plus setup. How do I move on to do the Regedit part?

    1. Giedrius Majauskas (admin)
      Post author

      Run Microsoft Windows XP. No need to run setup.

  3. R&b

    Appreciate the help but step 5 is just unreadable. If you are going to write instructions can you please make them possible to follow.

    1. Giedrius Majauskas (admin)
      Post author

      R&B: Watch the video. Without it, the step requires some deeper understanding of how Windows registry works.

  4. Ben42

    I tried going on safe mode and disabling all the startup entries but now it’s completely screwed
    up my computer. Nothing will open properly, even the Internet. What have I done wrong?

    1. Giedrius Majauskas (admin)
      Post author

      Ben42: Disable proxy server. This might be after-effect for malware. You can always revert items you have checked it msconfig.

  5. susie

    I can’t find the Interpol virus file, and don’t really know what I am looking for. Any suggestions how I would find it?

    1. Giedrius Majauskas (admin)
      Post author

      Susie : Make sure you see hidden and system files. Check MSConfig, if it is simpler version of parasite, it will be listed somehow ( in %appdata% or its subfolders usually, do not delete anything from C:\Windows ). The best way is to scan with anti-malware program.

  6. Jenny

    Hi, Iv got the winlogon open but there isnt “shell” in it too, what should i do?

    1. Giedrius Majauskas (admin)
      Post author

      Jenny: Look for other instances.

  7. Colby

    I have opened with command prompt and have enter regedit but I cant find winlogon anywhere, what should I do?

    1. Giedrius Majauskas (admin)
      Post author

      It should be there. You could try running rstrui from command line as well, to restore to previous date and then scan with anti-malware programs from normal mode as well.

  8. NC

    The video help me removed the virus. If the video was more clear would it been better! Thanks…

    1. Giedrius Majauskas (admin)
      Post author

      Good to hear and sorry for the video quality 🙂

  9. Berlie

    I followed the procedure in the video and the virus was removed. thanks a lot man.

  10. amy

    Followed the video and it worked perfect, thank you

    1. Giedrius Majauskas (admin)
      Post author

      amy : glad we had helped!

  11. Tanya

    The vide worked until I had to try to download spyhunter or spybot,they will not download, Keep getting a warning that says was deleted because there was a virus? Please help I have went thru this 3 times today!

    1. Giedrius Majauskas (admin)
      Post author

      Tanya: You have additional infection. Try using hitman pro Kickstarter usb ( create one on uninfected PC)., run application, put empty usb disk in, choose create kickstart usb, after that boot infected PC from it.


Leave a Reply

Your email address will not be published. Required fields are marked *