Polizia Postale virus - How to remove

Polizia Postale virus is a ransomware that attacks computers located in Italy. It locks targeted computer and displays a notification saying that you have breached Italian law by downloading illegal music or films. In order to get your system unlocked, it recommends paying 100 euro fine to the Italian Police and the problem will be fixed. It is clear that such statements may scare computer users and they agree to pay without even thinking. However, you should remember that no legal institutions would ever use such methods to collect fines. Polizia Postale virus is just another scam that cyber criminals have created to rip computer users off.

Here is a notification that you will receive if your system was infected. Obviously the message is written in Italian.

Polizia Postale e delle comunicazioni
Centro Nacionale Anticrime Informatico per la Protezione delle Infrastutture Critiche
Attenzione!!!
È stata rivelata un’attività illegale, il sistema operativo è stata bloccata per una violenza delle leggi della Repubblica Italiana!
È stata fissata una seguente violazione: dal tuo indirizzo IP era eseguito un accesso alle web-pagine contenenti la pornografia, la pornografia minorile, zoofilia, nonchè la violenza dei bambini.

Polizia Postale virus is closely related to similar ransomware program, such as FBI Moneypak, Interpol Department of Cybercrime virus, etc. All of these programs belong to Ukash viruses and they operate using the same principle. All of these programs use Paysafecard system to collect the fines. Remember that although it’s a comfortable payment system, police would never use such methods to collect fines. As already mentioned, Polizia Postale virus was designed specifically for Italian speaking countries. For this reason, it uses the name of local police and provides all the information in Italian.

Beware that the only way to unlock your computer and be able to use it normally again is by removing Polizia Postale virus. If you pay a so-called fine, your computer will only be unlocked temporarily and it is just a matter of time when it will be locked again. Follow the steps provided below and eliminate Polizia Postale virus as soon as possible.

How to remove Polizia Postale virus

The easiest way to get rid of this ransomware is by scanning one’s PC from another user account with Spyhunter, Hitman or other anti-malware tool. If you do not have one, do the following:

1. Reboot, and press F8 while screen is blank.
2. Choose safe mode with command prompt.
3. Run control nusrmgr.cpl, create another account.
4. Reboot and log in that account.
5. Run Anti-Malware scan.

If this fails, there are other options to get rid of Polizia Postale virus:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt.

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking and you see no blank screen instead of Polizia Postale virus one

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data. Note, that these are typical locations for Polizia Postale virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Polizia Postale virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
3. Search registry for Polizia Postale virus files and delete the registry keys referencing the files.
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe).

If none of safe modes could be launched

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Polizia Postale virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen).
3. When USB is ready, reboot infected PC with USB attached and press DEL.
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal