SPAUTORES virus - How to remove

SPAUTORES virus is a new ransomware that targets computer systems in Portugal. It was designed by cyber criminals just like a bunch of previously released ransomware. The program locks your system down saying that you have been using and distributing copyrighted content illegally. It tells you to pay a fine of 100 euros for this law violation. SPAUTORES (Sociedade Portuguesa de Autores) is in fact an institution that takes care of authors in Portugal and protects their rights and interests. It’s a smart step by cyber criminals to use this name making their scam to look like a real notification about breaking the law. The message by SPAUTORES virus looks like this:

SPAUTORES
Sociedade Portuguesa de Autores
O seu computador foi bloqueado.
Foram detetados descarregamentos de peças musicais ilegais(piratas) no seu computador.
Pode ser facilmente identificado através da resolução do seu endereço IP e nome de host associado.
Para desbloquer o seu computador e evitar consequências legais, é obrigado a pagar uma taxa de liberação de € 100.

Although the notification even includes the name of Portuguese police, you should never trust it.Police would never monitor your activities online and most importantly, they would not just lock your computer telling you to pay a fine. What is more, SPAUTORES virus asks you to pay the fine through Paysafecard payment system, which is based on payments using pre-paid cards. This is another clue showing that it has nothing to do with SPAUTORES organization and police. They simply would not use such means to pay the fine.

Do not fall for this scam under any circumstances. Remove SPAUTORES virus from your system as soon as you detect it. If you have access to other user account, use a reputable antispyware program, for example, Spyhunter. Follow instructions below as you probably will not be able to run your antispyware that easily. Please note, there is more than one version of this ransomware therefore you should use the removal method that is effective with your infection.

WHEN SAFE MODE WITH NETWORKING CAN BE LAUNCHED
1. Restart your computer, press F8 while it is restarting;
2. Choose safe mode with networking;
3. Launch MSConfig;
4. Disable startup items rundll32 turning on any application from Application Data;
5. Restart your computer again.
6. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to find the SPAUTORES virus files and remove them. Here is a video guide, showing how to do all the steps:

WHEN SAFE MODE WITH COMMAND PROMPT CAN BE LAUNCHED

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here is how to delete SUISA virus using this approach:

1. Reboot into safe mode with command prompt. SPAUTORES virus should not be launched this time.
2. Run regedit. Search for Winlogon.
3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of user’s folders, replace it with explorer.exe.
4. Save changes, reboot to safe mode with networking.
5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete SPAUTORES virus executables it finds.

Here is a video guide illustrating this virus removal method:

If SPAUTORES virus blocks any safe mode and you cannot access other user account to run https://www.2-viruses.com/downloads/spyhunter-i.exe, you may wish to try using Bootable antivirus CD/USB disk and scanning with it.

 

Automatic Malware removal tools

Manual removal