Ravnateljstvo Policije virus - How to remove

Ravnateljstvo Policije virus is a ransomware that attacks computers located in Croatia. The program uses a name of local police in order to trick random users and swindle their money away. It basically displays a message on the infected computer that hides under the name of Croatian Police. The message blames you for using some copyrighted content without permission and asks to pay a fine for this law violation. The most annoying is that the program completely locks your computer and does not allow to do anything there. None of your programs will work, you will not be able to browser the Internet, etc.

It is quite normal that many people get really worried about it. Nobody wants to have any problems with police. For this reason, many users who agree to pay whatever it takes just to avoid any further dealing with the police. However, before making any money transfer you should have a closer look at the message by Ravnateljstvo Policije virus.

Ravnateljstvo Policije
Sindikat Policije Hrvatske
UPOZORENJE! Vaš osoban kompjuter je blokiran zbos sisurnosnih mjera iz sljedečih raziosa.
Vi ste optuženi za gledanjeiskladištenje distribuciju pornografskog materijala zabranjenog sadržajem (pornografijaisodomijaisilovanje, itd.). Vi ste prekršili Svjetsku Deklaraciju o borbi protiv širenja dječje pornografije i optuženi za kažnjeno djelo iz članka 161. Kažnjenog zakona Republike Hrvatske. Članak 161. Kažnjenog zakona Republike Hrvatske predvida svrhu kažnjavaja zatvorsku kaznu u trajanju od 5 do 11 godina.
Kaznu morate platiti u roku od 48 sati od povrede. Nakon 48 sati isteka, za daljnjih 48 sati će biti automatski prikupljeni sve informacije o Vama i protiv Vas de biti pokrenut krivični postupak. Iznos vaše kazna je HRK 500 Kuna. Kaznu možete pLatiti novčanim vaučerima PaySafeCard. Nakon plačenja kazne novac de biti doznačeni na račun d,žave, vaš kompjuter de se odblokirati u roku od 24 sata.

First of all, police would never warn you about your unpaid fines using such methods. It would never block your computer and most importantly, it would never ask you to pay fine using payment systems that require prepaid cards. Ravnateljstvo Policije virus suggests using Ukash or PaySafeCard in order to make a money transfer.

You should never trust Ravnateljstvo Policije virus. It’s a scam created by computer hackers who only want to get your money. If your computer has been locked you can be sure it was attacked by one of the Ukash group viruses. Use a reputable antispyware program and remove Ravnateljstvo Policije virus as soon as you detected it on your computer.

If your computer has more than one user account and not all of them are locked, scan whole PC with anti-malware programs, e.g. spyhunter, by logging to the account that is not blocked. Another option is to use system restore. If none of these methods worked for you, do the following:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for Ravnateljstvo Policije virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Ravnateljstvo Policije virus  files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
3. Search registry for Ravnateljstvo Policije virus  files and delete the registry keys referencing the files
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If none of safe modes could be launched

Some versions of Ravnateljstvo Policije virus disable all safe modes, but give a short gap that you can use to run anti-malware programs:

1. Reboot normally.
2. Start->Run.
3. Enter: http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. Ravnateljstvo Policije virus process should be killed.

Here is a video detailing this approach:

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Ravnateljstvo Policije virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC. 
2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
3. When USB ready, reboot infected PC with USB attached and press DEL
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal