ICSPA Virus - How to remove

ICSPA Virus is a ransomware program that attacks computer users of several countries using different versions of notifications in different languages. The letters ICSPA stand for International Cyber Security Protection Alliance and it mainly targets computers located in the UK, Ireland, Canada, the United States and Australia. The warning always contains its logo and a name of a local police institution or other law authority. Some of the names that come with ICSPA virus message are FBI Cybercrime Division, Metropolitan Police, United Kingdom Police and others. Cyber criminals have recently updated this ransomware.

ICSPA Virus displays a message on the screen of the infected computer saying that you have been using and distributing copyrighted content and this way violated the law of your country. At last you are asked to pay a fine which varies from 100 to 300 euros or dollars most of the time and depending on which country the badware is attacking.

The purpose of ICSPA virus is to get money from computer users by accusing them for violating the law. Again depending on which country you live in, it asks to pay a fine using Ukash, Paysafecard or Moneypak payment systems. You should ignore these accusation and never pay anything what it tells you. No law authority would use such methods to announce about your faults and they would never collect fines using pre-paid cards.

You are highly recommended to remove ICSPA Virus from your computer once you notice its traces on your machine. You can be sure that it’s a badware that is only looking for a way to rip off your money. We provide you with removal instructions of ICSPA virus below. Follow these steps to get rid of this ransomware for good:

1. Restart your computer, press F8 while it is restarting.
2. Choose safe mode with networking.
3. Launch MSConfig.
4. Disable startup items rundll32 turning on any application from Application Data.
5. Restart your computer again.
6. Scan with ”https://www.2-viruses.com/downloads/spyhunter-i.exe” to find the file and remove it. Here is a video guide, showing how to do all the steps:

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here is how to delete ICSPA virus using this approach:

1. Reboot into safe mode with command prompt. ICSPA virus should not be launched this time.
2. Run regedit. Search for Winlogon.
3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of users folders, replace it with explorer.exe.
4. Save changes, reboot to safe mode with networking.
5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete ICSPA virus executables it finds.

Here is a video guide illustrating this virus removal method:

Note, that if each safe mode is blocked and you can not access other user account and run ”Anti-Malware scan from there, there is a chance to clean the PC again.
We recommend either using Bootable antivirus CD/USB disk and scanning with it or calling +1-888-334-2444 (USA / CA ) for help.

Automatic Malware removal tools

Manual removal