Politie Office Central virus - How to remove

Politie Office Central virus is a ransomware that seeks to get money from random computer users in Belgium. The program enters computers with a help of Trojan viruses that ensure the infiltration will be secret until finished. Once inside, Politie Office Central virus makes some changes in your system which lead to blocking your computer and trying to swindle your money away. Basically, it imitates a warning from Belgian police accusing you on violating some law and asking to pay a fine.

The program displays a message on the screen of the infected computer claiming that you have been doing some illegal activity on your computer related to watching and distributing copyrighted content. The application warns that you have to pay a fine of 100 euros if you want to get your computer unblocked. While it’s blocked, Politie Office Central virus does not allow you to open any of your programs, browse the Internet, etc. Not even your task manager works. Here is a part of a message:

Politie Office Central
DE LUTTE CONTRE LA CRIMINALITE LIEE AUX
TECHNOLOGIES DE L’INFORMATION ET DE LA COMUNICATION
Attention! Votre ordinateur est bloqué à cause d’un ou de plusieurs motifs indiqués ci-dessous.
Vous avez violé la loi <> (Vidéo, Musique, Logiciel) et vous avez illégalement servi et/ou diffuse le contenu protégé par le droit d’auteur, de ce fait vouz avez violé l’article 128 du Code penal de la Belgique. […]
La some de l’amende fait 100€.

Do not get scared by this false warning. If you have a closer look, you will see that the fine is asked to be paid using Ukash or PaySafeCard systems which require a pre-paid card in order to make a transfer. No police institution would ever use such methods to collect fines. Remove Politie Office Central virus as soon as you detect it on your computer. Do not pay anything this program tells you. It’s a scam that only uses a name of police in order to get your trust. However, it’s not related to police in any sense.

If your PC has more than one user’s account and at least one of them is not blocked, log in to an unaffected account and scan your computer with anti-malware programs, e.g. spyhunter. Another method to remove Politie Office Central is using System Restore. You should restore your computer to the date before the infection. Please note that even though the blocking might have been removed, the virus remains inside your computer therefore it is extremely important to perform a full system scan using antimalware tools. It might be that those you have installed are blocked by this ransomware therefore it is recommended to either check if your computer protection is functioning properly or use another program, such as spyhunter.

If neither of the methods works for you, restart your computer and press F8 while it is booting. Select Safe Mode. If the virus blocks it, select Save Mode with Networking. If it is also blocked, select Safe Mode with Command Prompt. Follow the steps below:

Removal using Safe mode or Safe mode with networking

1. When your computer runs in a needed mode, launch MSConfig;
2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for Politie Office Central virus but some others might be used;
3. Restart the system once again;
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Politie Office Central virus files and delete it.

Here is a video of a very similar virus that illustrates what to do for it to be removed:

Removal with Safe Mode with Command Prompt

1. When your computer works in a needed Mode, run Regedit;
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
3. Search registry for Politie Office Central virus files and delete the registry keys referencing the files.
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If virus disables all safe modes

1. Reboot normally.
2. Start->Run.
3. enter : http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. Politie Office Central virus process should be killed.

Here a video detailing this approach:

Hitman Pro USB disk

If all of the above failed, you might need to use a bootable USB or DVD disk having antivirus installed on it. The latter method should be able to remove all versions of Politie Office Central virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
3. When USB ready, reboot infected PC with USB attached and press DEL
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal