ICSPA Virus - How to remove


ICSPA Virus is a ransomware program that attacks computer users of several countries using different versions of notifications in different languages. The letters ICSPA stand for International Cyber Security Protection Alliance and it mainly targets computers located in the UK, Ireland, Canada, the United States and Australia. The warning always contains its logo and a name of a local police institution or other law authority. Some of the names that come with ICSPA virus message are FBI Cybercrime Division, Metropolitan Police, United Kingdom Police and others. Cyber criminals have recently updated this ransomware.

ICSPA Virus displays a message on the screen of the infected computer saying that you have been using and distributing copyrighted content and this way violated the law of your country. At last you are asked to pay a fine which varies from 100 to 300 euros or dollars most of the time and depending on which country the badware is attacking.

The purpose of ICSPA virus is to get money from computer users by accusing them for violating the law. Again depending on which country you live in, it asks to pay a fine using Ukash, Paysafecard or Moneypak payment systems. You should ignore these accusation and never pay anything what it tells you. No law authority would use such methods to announce about your faults and they would never collect fines using pre-paid cards.

You are highly recommended to remove ICSPA Virus from your computer once you notice its traces on your machine. You can be sure that it’s a badware that is only looking for a way to rip off your money. We provide you with removal instructions of ICSPA virus below. Follow these steps to get rid of this ransomware for good:

  1. Restart your computer, press F8 while it is restarting.
  2. Choose safe mode with networking.
  3. Launch MSConfig.
  4. Disable startup items rundll32 turning on any application from Application Data.
  5. Restart your computer again.
  6. Scan with ”https://www.2-viruses.com/downloads/spyhunter-i.exe” to find the file and remove it. Here is a video guide, showing how to do all the steps:

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here is how to delete ICSPA virus using this approach:

  1. Reboot into safe mode with command prompt. ICSPA virus should not be launched this time.
  2. Run regedit. Search for Winlogon.
  3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of users folders, replace it with explorer.exe.
  4. Save changes, reboot to safe mode with networking.
  5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
  6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete ICSPA virus executables it finds.

Here is a video guide illustrating this virus removal method:

Note, that if each safe mode is blocked and you can not access other user account and run ”Anti-Malware scan from there, there is a chance to clean the PC again.
We recommend either using Bootable antivirus CD/USB disk and scanning with it or calling +1-888-334-2444 (USA / CA ) for help.

Automatic Malware removal tools

Download Spyhunter for Malware detection

Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,

Download Combo Cleaner for Malware detection

Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,

Manual removal

Removal guides in other languages

5 responses to “ICSPA Virus

  1. I ran safe mode with command prompt, followed the steps and didnt see “shell”. please help ASASP

  2. i havent had an computer for long (6 mo.) if this i what its all about its a waist of money. if you can help i would appreciate it.

  3. How do you remove this virus from a phone? It has locked the phone and we can’t get it off.

  4. Download a trustworthy anti-virus application from app store. It should solve the problem. If you can’t access it, you will probably need to reinstall your operating system

Leave a Reply

Your email address will not be published. Required fields are marked *