The Cheshire Police Authority Virus - How to remove?


The Cheshire Police Authority virus is a ransomware that tries to trick money from people. The sums are as big as £100 from every infection if the victim gets on the scammers’ hook. Here is how this virus works:

  • It pretends to be sent by the United Kingdom Police (Metropolitan Police) as a punishment for breaching the law therefore has institution’s name and logo included in the warning message;
  • The Cheshire Police Authority virus locks an infected computer’s screen making the system unresponsive to almost any commands;
  • An infected computer displays a warning message that includes Metropolitan Police logo, extracts from laws related to illegal using of copyrighted content, sending spam and similar;
  • For the supposed punishment to be removed, one must pay a fine as soon as possible.

Scammers make the alert look as legitimate as possible because the more people believe in it, the more money they get. The message not only displays computer’s IP address and its location but also opens a camera window filming the surroundings and the person sitting in front of the computer. The Cheshire Police Authority virus is programmed to turn a webcam on if one is installed. All of these tricks can surely make people scared yet one should know that police authorities do not use such punishment methods like blocking one’s computer remotely. Another clear sign that you are facing a scam is the method of collecting fines. Once again, none of official authorities use prepaid payment systems whereas the Cheshire Police Authority virus asks you to pay the fine using Ukash or Paysafecard code. No wonder that this method is used by the scammers. It is particularly difficult to trace PIN’s paid therefore even if you report about the crime; criminals are quite safe from being disclosed.

The text of the message might look like this though it might be changed a little time to time:

United Kingdom Police
Metropolitan Police – PCEU
Cheshire Police Authority
ATTENTION! Your PC is blocked due tout least one of the reasons specified below.

You have been violating. Copyright and Related Rights Law. (Video, Music, Software) and illegally using or distributing copyrighted content, thus infringing Article 128 of the Criminal Code of Great Britain.
The amount of fine is £100. You can pay a fine Ukash or PaySafeCard.
When you pay the fine, your PC will get unlocked in Ito 72 hours after the money is put into the State’s account. Since your PC is unlocked, you will be given 7 days to correct all violations. In case all violations are not corrected after 7 working days, your PC will be blocked again, and a criminal case will be initiated against you automatically under one or more articles specified above.

As you may see, criminals promise to remove the blocking after they receive the money. Yet it is not true. By paying the fine you will not fix your computer. Below are the Cheshire Police Authority virus removal instructions suitable for the most common types of infection. For a full list of instructions for rarer versions of Trojan consult here.

Removal Instructions for the Cheshire Police Authority Virus


If your computer has more than one user‘s account and at least one of them is not blocked, login to it. After that scan your computer with anti-malware programs, e.g. Spyhunter. It will help to get rid of the infection. System restore would be an option too. If this method does not work for you, follow the guide below.

Use Safe Mode or Safe Mode with Networking

  1. Restart your computer; press F8 while it is restarting.
  2. Choose safe mode or safe mode with networking. If the Cheshire Police Authority virus blocks selecting of these modes go to the next removal method.
  3. Launch MSConfig.
  4. Disable startup items rundll32 turning on any application from Application Data;. Note, that some other locations for the Cheshire Police Authority virus might also be used.
  5. Restart the system once again.
  6. Scan with to identify Ukash Virus files and delete it.

Here is a video guide of a ransomware very similar to the Cheshire Police Authority virus that illustrates the steps above:

Use Safe Mode with Command Prompt

  1. Reboot PC in safe mode with command prompt.
  2. Run Regedit.
  3. Search for WinLogon Entries. write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
  4. Search registry for files related to the Cheshire Police Authority virus and delete the registry keys referencing the files.
  5. Try to reboot and scan with Spyhunter.
  6. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe).

If none of the methods worked for you, try the ones listed in the second part of this article about Ukash virus or leave a comment below.


Automatic The Cheshire Police Authority Virus removal tools

  Download Spyhunter for Cheshire Police Authority Virus detectionNote: Spyhunter trial provides detection of parasite like Cheshire Police Authority Virus and assists in its removal for free. You can remove detected files, processes and registry entries yourself or purchase a full version.
* Support is performed by Callstream.
  We might be affiliated with some of these programs. Full information is available in disclosure

Manual The Cheshire Police Authority Virus removal


Important Note: Although it is possible to manually remove Cheshire Police Authority Virus, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Spyhunter or other tools found on


It is impossible to list all file names and locations of modern parasites. You can identify remaining parasites, other Cheshire Police Authority Virus infected files and get help in Cheshire Police Authority Virus removal by using Spyhunter scanner. 


The Cheshire Police Authority Virus screenshots

May 16th, 2016 12:33, May 16th, 2016 12:33
Fill this form to subscribe to our newsletter

15 thoughts on “The Cheshire Police Authority Virus

  1. james kemp

    My computer has this virus and it is a packard bell it will not let you on the windows page at all all it does is go to a blank screen please help

    1. Giedrius Majauskas (admin)
      Post author

      James : look at other removal videos.

  2. melanie

    my husbands pc has this virus on his Dell, watched ur video and did step by step gide no luck!…really Annoyed!!

    1. Giedrius Majauskas (admin)
      Post author

      Melanie: try scanning from other account on the PC or create hitman pro kickstarter usb :

  3. jj

    my computer is infected with the cheshire, wont let me start up any of the safe modes, what can i do

    1. Giedrius Majauskas (admin)
      Post author

      Use Hitman pro kickstarter USB.

  4. Connor

    i got this virus and everytime i log on in safe mode it flashes up the start bar but then imediatly restarts – any tips??

    1. Giedrius Majauskas (admin)
      Post author

      Connor: try safe mode with command prompt.

  5. NNick

    Picked up the Cheshire malware – Followed instructions, reset to previous backup point and problem sorted – thank you

  6. Emma

    Thanks for the info. I followed the command prompt and all looks to be back to normal. Please can you advise if this malware affects all users of a PC? Would I need to follow the same process for all users?

    Thank you

    1. Giedrius Majauskas (admin)
      Post author

      Emma : depends on version. Run a full system scan to be safe.

  7. Peter

    I’ve got this in mine. I’ve tried doing rstrui.exe on safe mode but it has not removed it. Can you advise I have a HP with Vista (2007).

    1. Giedrius Majauskas (admin)
      Post author

      Peter : Try scanning from Hitman Pro kickstarter USB, or use one of alternate approaches in guide. If safe mode starts, try first video.

  8. Jerome

    Hi there! I have a “Chishire Police Authority” virus on my mobile (Sumsung Galaxy Note II”. The phone is already on Safe Mode. Where do I go next to remove the virus?

    1. Giedrius Majauskas
      Post author

      Hello, try to follow our manual removal instructions. It can be found below this article.


Leave a Reply

Your email address will not be published. Required fields are marked *