Serviciul De Combaterea A Criminalităţii Informatice virus - How to remove

Serviciul De Combaterea A Criminalităţii Informatice virus is a ransomware that targets computers i Romania. The program uses the name of Romanian Police (Poliţia Romana) and tries to scare the users of infected machines that they have done something illegal and attemots to make you pay a fine for that. Serviciul De Combaterea A Criminalităţii Informatice virus is distributed to computers over compromised websites. The Trojan gets into your system without your consent once you click on some infected link. It can also come attached on spam emails, so be careful opening any of them either.

Once inside the system Serviciul De Combaterea A Criminalităţii Informatice virus blocks your computer and displays a message on the screen saying that your computer has been blocked because you are involved into some illegal activity. The program states that you must pay a fine of 100 EUR or 300 RON because you have been using and distributed pornographic material and copyrighted content. Here’s a part of the message that you will receive if you get infected:

Serviciul De Combaterea A Criminalităţii Informatice
structura specializata a Politie Romana in investigarea infractiunilor din domeniul informatic
Atenţie! PC-ul Dvs. este blocat din cauza cel puţin a unuia dintre motivele specificate mai jos.
Dvs. aţi încălcat Legea privind drepturile de autor şi drepturile conexe. (Video, Muzică, Software) prin utilizarea sau distribuirea neautorizată a conţinutului protejat de dreptul de autor, încălcând astfel Articolul 128 din Codul Penal al României.
Articolul 128 din Codul penal prevede o amendă la 200 la 500 de salarii minime sau un privarea de libertate de la 2 la 8 ani.

The notification looks quite scary especially because police is involved into that. Although you don’t want to have any problems with police you should take a closer look at the message and you will understand that it’s a scam. Police would never ask you to pay any fines this way. Especially through such payment systems as Paysafecard or Ukash. You should never trust this message and remove Serviciul De Combaterea A Criminalităţii Informatice virus as soon as possible.

If you have access to other user account, use a reputable antispyware program, for example, Spyhunter. Follow instructions below as you probably will not be able to run your antispyware that easily. Please note, there is more than one version of this ransomware therefore you should use the removal method that is effective with your infection.

WHEN SAFE MODE WITH NETWORKING CAN BE LAUNCHED
1. Restart your computer, press F8 while it is restarting;
2. Choose safe mode with networking;
3. Launch MSConfig;
4. Disable startup items rundll32 turning on any application from Application Data;
5. Restart your computer again.
6. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to find the Serviciul De Combaterea A Criminalităţii Informatice virus files and remove them. Here is a video guide, showing how to do all the steps:

WHEN SAFE MODE WITH COMMAND PROMPT CAN BE LAUNCHED

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here is how to delete Serviciul De Combaterea A Criminalităţii Informatice virus using this approach:

1. Reboot into safe mode with command prompt. Serviciul De Combaterea A Criminalităţii Informatice virus should not be launched this time.
2. Run regedit. Search for Winlogon.
3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of user’s folders, replace it with explorer.exe.
4. Save changes, reboot to safe mode with networking.
5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete Serviciul De Combaterea A Criminalităţii Informatice virus executables it finds.

Here is a video guide illustrating this virus removal method:

If Serviciul De Combaterea A Criminalităţii Informatice virus blocks any safe mode and you cannot access other user account to run https://www.2-viruses.com/downloads/spyhunter-i.exe, you may wish to try using Bootable antivirus CD/USB disk and scanning with it.

 

Automatic Malware removal tools

Manual removal