Koda virus - How to remove

Koda virus is a scam that attacks computers by blocking them completely. It is one more version of widespread viruses such as FBI virus, Ukash virus, Canadian Mounted Police ransomware or the like. They all use the name of governmental authorities to swindle people‘s money away. This particular scam is designed for machines located in Denmark.

Once Koda virus is inside you will see a message telling that your system is locked due to a list of laws violations:

Der er fundet musik, som er ulovligt downloadet (piratkopieret), på din computer.

Ved at downloade musikken er den blevet reproduceret, hvilket er en kriminel handling i henhold til Afsnit 106 i Loven om ophavsret.
……
Du kan identificeres ved, at din IP-adresse og det tilhørende værtsnavn analyseres.

You would be blamed for illegal usage and distribution of copyrighted content, such as movies, music or other and even for using of pornographic content. To unblock your computer you are asked to pay a fine of 1000 DKK. This is how scammers earn their easy money.

Koda virus gets inside a computer using exploit kits. It is also known to be used to make money from machines already having malware. You will not see any signs of its infection before the rogue has made all the necessary changes to the system. Typically there is no gap between the time you login to your computer and warning screen loads. One more feature characteristic to Koda virus is display of the locking screen even in a safe mode with networking and blank screen in a safe mode. Due to these reasons it is complicated to remove Koda virus from computer.

Depending on the way a computer is infected there are these ways to get rid of the virus. If only one user account on the system is infected, you should perform a system scan using anti-malware programs, such as spyhunter. Do it using another account. Most of the time it will cure infected system too.

For those who do not have unaffected system user account, here is a detailed guide for Koda virus removal:

1. Reboot into safe mode with command prompt. Koda virus should not be launched there.
2. Run regedit. Search for Winlogon.
3. There will be a key labeled Shell under Winlogon. It should reference Explorer.exe or be blank. If there is something else referring an executable in one of user’s folders, replace it with explorer.exe.
4. Save changes, reboot to safe mode with networking.
5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete Koda virus executables it finds.

 

Automatic Malware removal tools

Manual removal