HADOPI virus - How to remove

HADOPI virus is a ransomware program that was designed by cyber crooks in order to steal money from random users. The program imitates a message from official French institution that is responsible for protection of copyrighted content. The program attacks computers located in French speaking countries. The message is not related to official HADOPI institution that is in fact taking care of rights protection. However, the use of this name makes the notification look more reliable and trick more users. Here’s how the message looks like:

Hadopi
Haute Autorité pour la diffusion des œuvres et la protection des droits sur Internet
Recommandation de la Commission de Protection des Droits de la Haute autorité pour la diffusion des œuvres et la protection des droits sur Internet (Hadopi)
Dossier n°
Date
Madame, Monsieur,
Attention, votre accès à internet a été utilisé pour commettre des faits, constatés par procès-verbal, qui peuvent constituer une infraction pénale.
En effet, votre accès internet a été utilisé pour mettre à disposition, reproduire ou accéder à des œuvres culturelles protégées par un droit d’auteur. Cette situation rend possible leur consultation ou leur reproduction sans autorisation des personnes titulaires des droits. De telles consultations ou reproductions, appelées couramment « piratage », constituent un délit sanctionné par les tribunaux.

As you see the message comes in French as it is meant to attacks French speaking computer users. HADOPI virus locks computer system and doesn’t allow to use any of your programs. The message says that you have violated the law by using copyrighted material without having rights for that. You are also instructed to pay the fine through Paysafecard or Ukash payment systems. Unfortunately, if you do so the money will go straight to the bank accounts of cyber criminals.

Although the message states that the only way to get your system unlocked is by paying this fine, that is not true. It is a scam that you should not fall for if you don’t want to lose your money. Follow our instructions below to remove HADOPI virus from your system as soon as you get your system infected. If you are able to login to more than one user’s account and at least one of them is not infected, login to it and scan your system using, for example Spyhunter. If you cannot login to your computer, try the following steps:

1. Restart your computer; press F8 while it is restarting;
2. Choose safe mode or safe mode with networking (it might be that HADOPI virus will not let you select safe mode or safe mode with networking, in such a case try the other method) ;
3. Launch MSConfig;
4. Disable startup items rundll32 turning on any application from Application Data;.
5. Restart the system once again.
6. scan with https://www.2-viruses.com/downloads/spyhunter-i.exe.

Here is a video of another ransomware but the removal steps are the same therefore it will help you to better understand what to do:

1. Restart your computer; press F8 while it is restarting;
2. Choose Safe mode with command prompt (if HADOPI virus does not let you choose this mode, visit this webpage for more removal tips) .
3. Run Regedit
4. Search for WinLogon Entries, write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
5. Search registry for HADOPI virus files and delete the registry keys referencing the files
6. Try to reboot and scan with Spyhunter.
7. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

 

Automatic Malware removal tools

Manual removal