The Guardia Di Finanza Virus - How To Remove?

Type: Ransomware

The Guardia di Finanza virus is a ransomware program that blocks computer systems and displays bogus message accusing you for some law violations. It was designed by cyber criminals in order to get money from computer users. The program completely locks the infected system and does not allow to run any programs there. The Guardia di Finanza message states that you have been involved into distribution of pornographic content and because of that you must pay a fine.

As you may guess from the name, the Guardia di Finanza virus attacks computers located in Italy. The message body comes in Italian as well. Basically, you will be asked to pay 100 euros using Ukash payment system and as the massage states your system will be unlocked. Even if you were actually involved into distributing some copyrighted content, police would never use such means to collect the fines. The Guardia di Finaza virus is just one more scam that is used to rip you off.

Beware that the program can affect your computer protection level as it can disable your security tools and leave your system open for other programs to infiltrate. The Guardia di Finanza virus is a harmful program that you should stay away from. Do not pay anything if you received this message on your computer. Instead you have to remove the Guardia di Finanza virus from your computer as soon as possible. Follow the steps below to get rid of this annoying program:

1. Restart your computer, press F8 while it is restarting
2. Choose safe mode with networking
3. Launch MSConfig
4. Disable startup items rundll32 turning on any application from Application Data;
5. Restart your computer again.
7. Scan with to find the file and remove it.

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here are steps how to do it:

  1. Reboot into safe mode with command prompt. The Guardia di Finanza virus should not be launched this time.
  2. Run regedit. Search for Winlogon.
  3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of users folders, replace it with explorer.exe.
  4. Save changes, reboot to safe mode with networking.
  5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
  6. Install and run Scan with it the PC and delete the Guardia di Finanza virus executables it finds.

Automatic The Guardia di Finanza virus removal tools

Note: Reimage trial provides detection of parasites and assists in their removal for free. You can remove detected files, processes and registry entries yourself or purchase a full version.  We might be affiliated with some of these programs. Full information is available in disclosure

Manual removal


Important Note: Although it is possible to manually remove Guardia di Finanza virus, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other tools found on


The Guardia di Finanza virus screenshots


About the author

 - Main Editor

I have started in 2007 after wanting to be more or less independent from single security program maker. Since then, we kept working on this site to make internet better and safer place to use.

January 24, 2013 11:55, June 3, 2013 13:47

Leave a Reply

Your email address will not be published. Required fields are marked *