Polizia Di Stato virus - How to remove

Polizia Di Stato virus is a Trojan that attacks computers located in Italy. It is programmed to block an infected system completely. After infection computer users can only see a window displaying a scary looking camera and a text threatening that your personality is known to official authorities:

Tutte le operazioni fatte a questo computer sono scritte. Se usa la webcam, video, foto si conservano per l’identificazione.
Lei può essere individuate facilmente per il Suo indirizzo IP e l’indirizzo del domain legato con esso.
Il tuo computer è stato bloccato!

The message informs that a blocked PC user has violated one of or several laws. These encompass illegal usage and distribution of copyrighted content, such as videos, music or other files, visiting forbidden web pages, watching and distribution pornographic files, etc. In order to unblock your computer, according to the alert, you must pay a fine of 100 EUR. You may use one of the methods: Ukash or Paysafe card. It promises to unblock your computer in 48 hours.

Please note that this is a scam and you should not pay anything. If you already made a payment, contact your credit card company as soon as possible and dispute the charges made. For the future records, remember that none of governmental institutions accept payments using prepaid payment systems.

Polizia Di Stato virus is distributed through exploit pages. It installs itself silently therefore a user does not know about the infection before it is too late. The warning message is displayed without any gap between logging in and warning screen loading. The same screen will be displayed in safe mode with networking and a blank screen in safe mode.

Polizia Di Stato virus is difficult to remove, yet a computer can be unblocked using one of the ways. If there is more than one user account on the system and at least one of them is unaffected you should scan a system with anti-malware programs like Malwarebytes or Spyhunter using an unaffected account.

How to remove Polizia Di Stato Virus

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for Polizia Di Stato Virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Polizia Di Stato Virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
3. Search registry for Polizia Di Stato Virus files and delete the registry keys referencing the files
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If none of safe modes could be launched

Some versions of Polizia Di Stato Virus disable all safe modes, but give a short gap that you can use to run anti-malware programs:

1. Reboot normally.
2. Start->Run.
3. Enter: http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. Polizia Di Stato Virus process should be killed.

Here is a video detailing this approach:

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Polizia Di Stato Virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC.
2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
3. When USB ready, reboot infected PC with USB attached and press DEL
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal