Spanish police virus - How to remove

Spanish police virus is ransomware, specific to Spain. While the program itself does not depend on country much, it detects the location of the PC and displays the message in appropriate language. This message is loaded from remote page, so on disconnected PC the malware either won’t load at all or will show a white screen.

The Spanish police virus screen will display a warning that you have downloaded illegal content or violated some sort of laws:

Atencion
Sur ordenador personal ha sido bloquedo por razones de seguridad vistos los motivos abajo detallados.
Usted esta acusado de mirar/conservar y/o divulgar los materiales pornograficos del contenido prohibido (pornografia infantil/Zoofilia/Violacion etc). Usted ha infringido la Declaracion mundial de la lucha contra la divulgacion de la pornografia infantil y esta acusado de cometer el crimen en razon al Articulo 161 del Codigo Penal del Reino de Espana.
El articulo 161 del Codigo Penal del Reino de Espana prefe a titulo de punicion la encarcelacion por el plazo desde 5 hasta 11 anos.

This text is direct translation from posts in other languages and the details in message and actual penalties are just for making you pay 100 USD fine. They ask you to pay the fine using pre-paid system Paysafecard Or Ukash , which should tip you that the Spanish police virus is not related to actual law enforcement institutions whateversort. These payments can not be charged back (like credit card ones) nor traced. Thus if you have paid the ransom, your money is gone.

Spanish police virus might block your PC, but it is still possible to fix it yourself. For that you should follow the guide below.

How to remove Spanish police virus

The easiest way to get rid of this ransomware is by scanning one’s PC from another user account with Spyhunter, Hitman or other anti-malware tool. If you do not have one, do the following:

1. Reboot, and press F8 while screen is blank.
2. Choose safe mode with command prompt.
3. Run control nusrmgr.cpl, create another account.
4. Reboot and log in that account.
5. Run Anti-Malware scan.

If this fails, there are other options to get rid of Spanish Police virus:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt.

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking and you see no blank screen instead of Spanish police virus one

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data. Note, that these are typical locations for Spanish police virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Spanish police virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
3. Search registry for Spanish police virus files and delete the registry keys referencing the files.
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe).

If none of safe modes could be launched

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Spanish police virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen).
3. When USB is ready, reboot infected PC with USB attached and press DEL.
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal