Bundeskriminalamt virus - How to remove

Bundeskriminalamt virus is a ransomware program that takes over computers completely and tries to get money from their users. This version of a program targets computers in Austria specifically. It hides under the name of Austrian police and displays a message in German. The ransomware is distributed using Trojan viruses and once inside it locks the computer immediately. None of the programs will work, including your security tools, Task Manager and so on. Bundeskriminalamt virus will only display a message in the center of the screen warning that your system has been locked because you have violated the law. Here is how the message looks like:

BUNDESKRIMINALAMT
.BK .LPD
Meldestelle Cybercrime und Kinderpornografie LandesPolizeiDirektion
WARNUNG! Zugang von Ihrem persönlichen Computer wurde vorläufig aus den unten aufgelisteten Gründen gesperrt.Ihnen wird die Ansicht/Lagerung und/oder den Vertrieb von pornographischem Material von verbotenen
Inhalte (Kinderpornografie/Zoophilie/Vergewaltigung, etc.) vorgeworfen. Sie haben die Allgemeine Erklärung zur Bekämpfung der Verbreitung von Kinderpornographie verletzt wegen einer Straftat nach Artikel 1 61 des Strafgeselzbuches der Republik Osterreich.
Die Strafe soll von Ihnen innerhalb von 48 Stunden nach der Verlelzung bezahlt werden. Sobald die 48 Stunden vergangen sind, werden innerhalb weiteren 48
Stunden alle Informationen über Sie automatisch gesammelt, und Sie werden strafrechtlich verfolgt. Die Größe der feinen beträgt €100 Euro. Sie können mit Hilfe PaySafeCard oder Ukash zahlen. Sobald die Geldbuße bezahlt wird und das Geld auf das Konto des Staates angerechnet wird, wird Ihr Computer innerhalb von 24 Stunden freigeschaltet.

As you see the program asks you to pay a fine of 100 euros to get your computer back to normal functioning. It basically states that you are responsible for illegal using and distributing of copyrighted material, pornographic content files and this is a violation of Austrian law. You will be offered to pay a fine via Ukash or Paysafecard payment systems for the charges to be removed.

Unfortunately, that is not true and the creators of Malware Protection only want to steal your money. It is an easy way for cyber criminals to earn money. In fact Bundeskriminalamt virus is not related to police at all and you shouldn’t worry about any accusations it lists in the message. If you have received this message on your computer, use some alternate scanner to scan your PC and eliminate Bundeskriminalamt virus from your system once you detect it’s traces.

If your computer has more than one user account and not all of them are locked, scan whole PC with anti-malware programs, e.g. Spyhunter, by logging to the account that is not blocked. Another option is to use system restore. If none of these methods worked for you, do the following:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt.

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for Bundeskriminalamt virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Bundeskriminalamt virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
3. Search registry for Bundeskriminalamt virus files and delete the registry keys referencing the files
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If none of safe modes could be launched

Some versions of Bundeskriminalamt virus disable all safe modes, but give a short gap that you can use to run anti-malware programs:

1. Reboot normally.
2. Start->Run.
3. Enter: http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. Bundeskriminalamt virus process should be killed.

Here is a video detailing this approach:

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Bundeskriminalamt virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
3. When USB ready, reboot infected PC with USB attached and press DEL
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal