CNAIPIC virus - How to remove

CNAIPIC virus (Centro Nazionale Anticrime Information per la Protezione delle infrastrutture Ctriche virus) is one more ransomware that attacks computers located in Italy. It ‘s a program that blocks your computer and displays a false message on your screen warning that you have to pay a fine because of some illegal actions. Usually it blames users for downloading music illegally or watching adult content on the Internet. Here is how the warning looks like:

Polizia Postale e delle comunicazioni
Centro Nacionale Anticrime Informatico per la Protezione delle Infrastutture Critiche
Attenzione!!!
È stata rivelata un’attività illegale, il sistema operativo è stata bloccata per una violenza delle leggi della Repubblica Italiana!
È stata fissata una seguente violazione: dal tuo indirizzo IP era eseguito un accesso alle web-pagine contenenti la pornografia, la pornografia minorile, zoofilia, nonchè la violenza dei bambini.

CNAIPIC virus usually infiltrates with a help of Trojan viruses and it completely takes over your system. It doesn’t allow users to browse or do anything else on their systems. Since the content of the message is quite scary and nobody likes to be involved with police, a lot of users agree to pay “a fine” and they hope the problem will be solved. Unfortunately, it is not really so. CNAIPIC virus reappears even after paying and users are not able to use their computers anyway.

You should keep in mind that CNAIPIC virus is a scam that was designed by cyber criminals and it has nothing to do to actual authorities. First of all, police would never block your computer to warn that you breached the law. Second, it doesn’t use such systems as Paysafecard to collect fines. Cyber criminals were just trying to play smart by using a name of local police to make the warning look more legitimate.

Removing CNAIPIC virus is the only solution for this issue. Do not even waste your money and do not pay one euro for the scammers. It is not easy to remove CNAIPIC virus, but we have provided a tutorial showing step-by-step how to do it.

How to remove CNAIPIC virus

The easiest way to get rid of this ransomware is by scanning one’s PC from another user account with Spyhunter, Hitman or other anti-malware tool. If you do not have one, do the following:

1. Reboot, and press F8 while screen is blank.
2. Choose safe mode with command prompt.
3. Run control nusrmgr.cpl, create another account.
4. Reboot and log in that account.
5. Run Anti-Malware scan.

If this fails, there are other options to get rid of CNAIPIC virus:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt.

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking and you see no blank screen instead of CNAIPIC virus one

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data. Note, that these are typical locations for CNAIPIC virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify CNAIPIC virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
3. Search registry for CNAIPIC virus files and delete the registry keys referencing the files.
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe).

If none of safe modes could be launched

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of CNAIPIC virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen).
3. When USB is ready, reboot infected PC with USB attached and press DEL.
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal