The “Jusu dators ir blokets” Virus - How to remove

The “Jusu dators ir blokets” virus is a ransomware designed to attack computers located in Latvia. It is programmed the same way as many other this type viruses, the most known of which is Ukash virus. As soon as the code is infiltrated into the system, it blocks a computer screen demanding for a ransom in order to unblock PC. For the latter feature this type of virus got its name. The design of the blocking message is made to look very professional. It has local police – the Latvian Police called Latvijas Policijas Kibernoziegumi Departaments – logo. The virus is capable of turning on webcam if such is installed and show the surroundings. The message near the cam window informs that this information will be used for your as criminal’s identification. The blocking text also includes true laws related to illegal distribution of copyrighted material, sending spam e-mails or even obtaining files with child pornography. Here is an extract from the text:

LATVIJAS POLICIJAS
KIBERNOZIEGUMI DEPARTAMENTS
JŪSU DATORS IR BLOKĖTS
Jūs esat parkapėjs, Jūsu darblba nav likumlga un paredz kriminalatbildibu.
Taiak minėti iespejami parkapumi: 174. pants – AutortiesTbas
BrtvTbas atnemšana no 2 ITdz 5 gadiem (Autordarbu izmantošana vai izplatTšana). Naudas sods no 9 OOO LVL ITdz 10 000 LVL
……….

According to the “Jusu dators ir blokets” virus message, a computer will be unblocked if you pay a fine of 100LVL as soon as possible. You should use Ukash or PaySafeCard code to do this. There are even places where to obtain prepaid payment card listed. Such method for collecting money is widely used among cyber criminals because it allows getting cash without being caught. Scammers later sell PINs collected at a reduced price and this way turn them into the money they can actually use. It is almost impossible to trace them.

Paying the ransom will not unblock your computer. Usually scammers do not send the encryption code as promised. For some versions of the virus such a code does not exist at all. The only reliable way to remove the “Jusu dators ir blokets” virus is by using special removal tools and follow instructions strictly. Methods effective on different virus versions are listed below:

When Safe Mode or Safe Mode with Networking function is active

1. Press F8 while rebooting your computer;
2. Choose Safe Mode or Safe Mode with Networking (if the “Jusu dators ir blokets” virus blocks it, go to the next removal method)
3. Launch MSConfig;
4. Disable startup items rundll32 turning on any application from Application Data.
5. Reboot your computer for the second time.
6. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify the “Jusu dators ir blokets” virus files and delete it. Below is a video showing how to do every step above:

When Safe Mode with Command Prompt is active

1. Reboot PC choosing Safe Mode with Command Prompt.
2. Run Regedit
3. Find WinLogon Entries and write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
4. Search registry for the “Jusu dators ir blokets” virus files and delete the registry keys referencing the files
5. Try to reboot and scan with spyhunter.
6. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe). Below is a video that shows how to complete this removal method:

When none of Safe Modes is active

Some versions of the “Jusu dators ir blokets” virus disable all safe modes. Yet usually there is a short gap before a blocking screen is displayed that you can use to run anti-malware programs. When you did that, follow these instructions:

1. Reboot normally.
2. Start->Run.
3. Enter : http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. The “Jusu dators ir blokets” virus should be eliminated. Below is a video showing how to remove ransomware:

If none of the above worked for removing the “Jusu dators ir blokets” virus

Use a bootable USB or DVD disk with the antimalware tool spyhunter installed on it. When you put it on an infected computer, the program will start automatically and remove infection.

Automatic Malware removal tools

Manual removal