Landespolizeidirection Virus - How to remove

Landespolizeidirection virus is a ransomware that belongs to a wide Urusay family. These Trojans are known to infect computer based on the country of its location. If the country where you work with your PC is not on the list of this family’s virus countries, you will not get blocked. If you see a message from Landespolizeidirection Bundes Ministerium fur Inneres locking your computer screen, you can be sure it is a virus.

Landespolizeidirection Trojan is distributed using system vulnerabilities and security holes. Usually one gets infected after browsing the Internet. The web pages visited do not have to be of malicious origin like sex sites. Cyber criminals can use any site by injecting malicious code there or displaying advertisements leading to corrupted web pages. In order for a source of infection to remain secret Landespolizeidirection virus is programmed to lock a computer screen more than 5 minutes after the actual infection.

Once a computer is blocked, you will see local police logos, extracts from laws related to Internet Security and even a logo of your own antivirus program:

ACHTUNG! Ihr Computer ist aus einem oder mehreren der unten aufgeführten Gründe gesperrt.
Sie haben gegen das Gesetz über «Urheberrecht und verwandte Schutzrechte» (Video, Musik, Software) verstoßen und unrechtmäßig urheberrechtliche Inhalte genutzt, bzw. Verbreitet und somit gegen Art. 128 des Strafgesetzbuches der Bundersrepublik Österreich verstoßen.

All of these tricks are used to make you believe that you breached the law and should pay the fine. Cyber criminals collect money using PINs via Ukash or Paysafecard. Prepaid payment systems enable them to steal money without being caught because it is very difficult to trace them. Although the message of Landespolizeidirection virus promises that after the payment is completed, your computer will be unblocked, this is not true. Paying the money will only encourage more of these types of crimes and will not remove the virus itself.

To remove Landespolizeidirection virus follow instructions below. Please note, there is more than one version of this ransomware therefore you should use the removal method that is effective with your infection.

WHEN SAFE MODE WITH NETWORKING CAN BE LAUNCHED
1. Restart your computer, press F8 while it is restarting;
2. Choose safe mode with networking;
3. Launch MSConfig;
4. Disable startup items rundll32 turning on any application from Application Data;
5. Restart your computer again.
6. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to find the Landespolizeidirection virus files and remove them. Here is a video guide, showing how to do all the steps:

WHEN SAFE MODE WITH COMMAND PROMPT CAN BE LAUNCHED

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here is how to delete Landespolizeidirection virus using this approach:

1. Reboot into safe mode with command prompt. Landespolizeidirection virus should not be launched this time.
2. Run regedit. Search for Winlogon.
3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of user’s folders, replace it with explorer.exe.
4. Save changes, reboot to safe mode with networking.
5. Run msconfig and disable all unnecessary startup entries. You should be able to reboot normally.
6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete Landespolizeidirection virus executables it finds.

Here is a video guide illustrating this virus removal method:

If Landespolizeidirection virus blocks any safe mode and you cannot access other user account to run https://www.2-viruses.com/downloads/spyhunter-i.exe, you may wish to try using Bootable antivirus CD/USB disk and scanning with it.

Automatic Malware removal tools

Manual removal