Den Svenska Polisen IT-Sakerhet virus - How to remove

Den Svenska Polisen IT-Sakerhet virus (aka Polisviruset) is a ransomware that attacks computers in Sweden. The program displays a message on the infected computer where it uses the name of official Swedish authorities. The text of the notice accuses users for making several crimes related to watching and distributing pornographic content and tells to pay a fine of 500 Swedish krones. It says that untill you pay the money your computer will remain blocked and if you don’t pay the fine you will have to face more serious consequences. The message is displayed in Swedish and here is how a part of it looks like:

Polisen
Den Svenska Polisen IT-Sakerhet
Din dator är låst – för ett eller flera skäl som anges nedan.
Du har brutit mot lagen ‘om upphovsrätt och närsående rättigheter” (Video, Musik, Software) eftersom du har olagligt användat och / eller distribuerat innehåll som skyddat för upphovsrätt och därmed du har brutit mot §l28 Straffrätt Sverige.
§128 Straffrätt Sverige föreskriver ett straff från 2 till 500 gånger minimilönen eller fängelse från 2 till s är.
Du har tittat eller distribuerat ett pomografiskt innehåll som är förbjudet (Child Porno /Zoofilia och etc). Det är ett brott mot §202 Straffrätt Sverige.
§ 202 Straffrätt Sverige föreskriver fängelse för en period av 4 till 12 år. Från din dator gjordes en olaglig tillgång till uppgifter eller du ….
§208 Straffrätt Sverige föreskriver ett straff till 100.000C eller fängelse för en period av från 4 till 9 år.
Eftersom från din dator gjordes olagligt tillträde utan din vetskap, år det möjligt att din datom blev infekterad med skadlig programvara. Det heter också att du bryter mot lagen om “En försummelse att använda en dator.”
§210 Straffrätt Sverige föreskriver ett straff från 20006 till 80006.
Eftersom från din dator (också om utan din vetskap) gjordes spam – sendning eller andra olagliga verksamheter med mål att göra en vinst, är det möjligt att din dator blev infekterad med skadlig programvara.

<….>

To make the problem even more realistic Den Svenska Polisen IT-Sakerhet virus accesses your webcam and shows what is happening in your room at that moment. There is no surprise that many users get scared of it and follow whatever it says just to end this mess. Besides, nobody wants to deal with police, especially when you are the one accused of something.

Unfortunately, if you pay a so called fine, the problem will still remain. That is because the message by Den Svenska Polisen IT-Sakerhet is a scam. Pay attention that the only way to pay the fine is using Ukash. Although it is a legitimate payment system, bear in mind that no official institution accepts such payments. The only correct way to unlock your computer is to remove Den Svenska Polisen IT-Sakerhet virus from your system.

If your machine has more than one user account and not all of them are locked, scan whole PC with anti-malware programs, e.g. spyhunter, by logging to the account that is not blocked. Another option is to use system restore. If none of these methods worked for you, do the following:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for Den Svenska Polisen IT-Sakerhet virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Den Svenska Polisen IT-Sakerhet virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
3. Search registry for Den Svenska Polisen IT-Sakerhet virus files and delete the registry keys referencing the files
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If none of safe modes could be launched

Some versions of Den Svenska Polisen IT-Sakerhet virus disable all safe modes, but give a short gap that you can use to run anti-malware programs:

1. Reboot normally.
2. Start->Run.
3. Enter: http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. Den Svenska Polisen IT-Sakerhet virus process should be killed.

Here is a video detailing this approach:

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Den Svenska Polisen IT-Sakerhet virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
3. When USB ready, reboot infected PC with USB attached and press DEL
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal