How to Remove Royal Canadian Mounted Police Virus (ICSPA Ransomware Removal Guide)

This forum is committed to providing guides to remove spyware, adware, trojans, worms, and other forms of malware.

How to Remove Royal Canadian Mounted Police Virus (ICSPA Ransomware Removal Guide)

Postby Sophia » 2013-02-15 20:49


An alert appears on your computer to claim that your computer is blocked due to some reasons of committing illegal activities online? Is this Royal Canadian Mounted Police alert real? Absolutely it is scam of the notorious ransomware. Read more in this post to get rid of this Royal Canadian Mounted Police virus or ICSPA virus as you may call it now.


The screenshot that you see below supposedly from Royal Canadian Mounted Police has nothing to do with RCMP at all. Instead, this is a nasty computer virus that attacks many computers located in Canada. This computer infection is categorized as ransomware, which freezes the desktop of your system and accuses of the users illicit involvement in using copyrighted content or spreading malware or porngraphics so as to try scaring innocent users to believe that and pay the bogus fine as it instructed. Everyone should be alerted about this serious online scam trend. In sight of this, we've written about some good to know information about this RCMP ransomware infection and then hopefully, our readers will find something useful for them to remove this ransomware and stay away from the risks of getting nfected.

        Royal-Canadian-Mounted-Police-virus.jpg


Similar Ransomware Infections:FBI moneypak virus, Citadel Reventon Malware, United States Cyber Security virus, FBI Ultimate Game Card virus, All Activity on This Computer Has Been Recorded-Fake FBI Warning infection, FBI Online Agent virus, Internet Crime Compliant Center Virus, PCeU virus (aka Metropolitan Police Ukash virus), Malex ransomware, Your computer is locked for violating the Law of Great Britain virus, DOJ virus, File Encryption Virus, SGAE virus, An Garda Síochána. Ireland’s National Police Service virus, ISCA 2012 virus, Automated Information Control System virus, ACCDFISA Protection Program ransomware, Celas ransomware, Votre ordinateur est bloque! Gendarmerie Ukash virus, Canadian Police Association Virus, Urausy virus/ransomware, Office Central de Lutte contre la Criminalité Virus, Bundesamt fur Polizei Virus, Canadian Police Cybercrime Investigation Department Virus, GEMA: Your computer has been locked virus, Den Syenska Polisen IT-Sakerhet Ransomware, Bundes Polizei Ukash virus, Australian Federal Police Ukash Virus, etc.

Royal Canadian Mounted Police ransomware makes an appearance on your screen out of the blue. This may occur unexpectedly and you have no clues to foresee anything bad that would occur. Then, you are lucky here with us at the moment that you are aware of this ransomware infection (BTW:this ransomware comes as one member from the Urausy malware clan.) Once infected , the entire system will be disabled from any operation. The victim user is totally locked out of their computer and also there will be a bogus warning in name of RCMP and ICSPA claims the user should pay a fine to unlock the computer. Even the repeated reboot of the computer using hard reset would fail to troubleshoot. The reasons for this lock screen is made as that the user has performed a lot of illegal activities online including illegal software, audio and video downloads, sending massive unsolicited spam, visiting the sites of terrorist organizations for the purpose of supporting them and, in particular, performing a lot of other illegal adult activities online. It is natural that some innocent users who receive such a message and condemnation might be freaked out. In particular, this may carry more weight when the victim user has done that.Be aware that even the case happens to be real, this is still a scam for money. Just think that how could the authority works this way ?? Even if you pay the fine, generally you will find that your computer remains locked.

Royal Canadian Mounted Police virus locker prompts users to pay the ransom fine through indication of Ukash of Paysafecard voucher (PIN) codes. And this Royal Canadian Mounted Police uses the logo of CPA (ACP), as well as that of ICSPA (International Cyber Security Protection Alliance) to make the text of the faulty accusation even more authoritative and scary. Please just rest aside your fear , this message is just fake and for scams by cyber crooks. You can just ignore it follow the malware removal guide below to remove the ransomware.


To get rid of this Royal Canadian Mounted Police virus, please follow below instructions:

Web cam control

    Image

    Once infected, there would be a little more than usual that this ransomware virus would even attempt to trick the user into thinking they are under surveillance by webcam, as it always shows a fake screen in “recording” status. Actually this even makes no difference on the infected computer with no web cam at all. Apparently, the truth is ready to jump out at your call.


Deny Flash

Most ransomware exploits Java or Flash vulnerabilities to load the malicious code. In some cases denying or disabling flash on your system may suspend the Royal Canadian Mounted Police ransomware viurs and enable the user to navigate through the infected system. If this not a necessity for removal, skip to the removal options below these steps.

To disable (deny) flash

    1.Visit:http://www.macromedia.com/support/documentation/en/flashplayer/help/help09.html

    Image

    2. Select the “Deny” radio option

    3. Proceed to a removal option (detailed below).



How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Remvoal Guide)


Note! This tutorial is effective for all GreenDot MoneyPak, Ukash and Paysafecard ransomware.

There are several ways to get rid of such Ukash ransomware depending on the specific situation of infection. If the computer can still boot into safe mode, please follow the Option 1 removal steps to go. If the computer is completely blocked from anything, including safe mode running, then bet on Option 2 removal steps to go.


Removal Option 1-Safe Mode with Command Prompt Restore

    Step 1> Launch your PC into Safe Mode with Command Prompt. During the start, keep pressing F8 key till the Advanced Windows Options Menu shows up and then use the arrow key on the keyboard to highlight the Safe Mode with Command Prompt option and then press Enter. See detailed instructions on how to boot Windows to Safe Mode

    Image

    Note: make sure you login your computer with administrative privileges. (login as admin)

    Step 2> Once the Command Prompt appears you only have few seconds to type “explorer” and hit Enter. If you fail to do so within 2-3 seconds, the ransomware virus will not allow you to type anymore.

    Image

    Step 3> Once Windows Explorer shows up browse to:

    Win XP: C:\windows\system32\restore\rstrui.exe and press Enter
    Win Vista/Seven: C:\windows\system32\rstrui.exe and press Enter

    Image

    Step 4> Follow all steps to restore or recover your computer system to an earlier time and date (restore point), before infection.

    Image

    Step 5> Download, install, update and runAnvi Smart Defender(http://www.anvisoft.com/software/asd/. Remove all threats detected and reboot your PC.

--------------------------------------------------------------------------------------------

Removal Option 2 Using Anvi Rescue Disk to Remove the Ransomware and Repair the Infected Computer


Chances are your PC is heavily infected by this ransomware that it is blocked from safe mode running as well. If such is the case, the removal may be a little bit complex and here we use Anvi Rescue Rescue Disk to demonstrate the removal steps and good luck to you. If any question in the process, just let us know.


Also below is a video of ransomware removal using Anvi Rescue Disk for reference.




    Step 1> Download the Anvi Rescue Disk isoimage file Rescue.iso and the USB disk production tool BootUsb.exe from Anvisoft official site.


    Direct download link: http://download.anvisoft.com/software/rescuedisk.zip


    Please kindly note that Rescue.iso is a large file download; please be patient while it downloads.


    Step 2> Record Anvi Rescue Disk iso image to USB drive. You can also record the iso image to a CD/DVD. We will introduce the steps to record iso image to a CD/DVD in following guide.


    Connect USB to computer. You’d better backup your important data and format your USB drive before use it to record the iso image.

    Locate your download folder and double-clicking on BootUsb.exe to start it. And then click “Choose File” button to browser into your download folder and select Rescue.iso file as your source file.

    Image


    Select the path of USB drive, such as Drive H:

    Click “Start Burning” to start the burn of USB Rescue Disk boot drive.

    Please close BootUsb.exe tool after you successfully burn the file to USB drive when you get following message.


    Image

    Now, you have bootable Anvi Rescue Disk to repair your computer.


    Alternative Option

    You can also record Anvi Rescue Disk iso image to a DV/DVD. Any CD/DVD record software is fine for burn iso image. If you don’t have any, you can download and install Nero Burning ROM and ImgBurn. Here we will use Nero Burning ROM for demonstration purpose.

    Please open and start Nero Burning ROM and select Burn Image from the drop-down menu of the Recorder.


    Image

    Locate your download folder and select Rescue.iso file as your source file and then click Open button.


    Image


    Click Burn button to start record the iso image. After a few minutes, you will have a bootable Anvi Rescue Disk to repair your computer.


    Image


    Step 3>Restart your computer and configure your computer to boot from USB drive/DV/DVD that recorded Anvi Rescue Disk. Basically , you can use F8 to load USB boot menu.

    For different motherboard, you may need to use the Delete or F2, F11 keys, to load the BIOS menu. Normally, the information how to enter the BIOS menu is displayed on the screen at the start of the OS boot.


    Image

    The keys F1, F8, F10, F12 might be used for some motherboards, as well as the following key
    combinations:

    • Ctrl+Esc
    • Ctrl+Ins
    • Ctrl+Alt
    • Ctrl+Alt+Esc
    • Ctrl+Alt+Enter
    • Ctrl+Alt+Del
    • Ctrl+Alt+Ins
    • Ctrl+Alt+S


    If you can enter Boot Menu directly then simply select your CD/DVD-ROM as your 1st boot device.

    If you can't enter Boot Menu directly then simply use Delete key to enter BIOS menu. Select Boot from the main BIOS menu and then select Boot Device Priority. After that, set USB drive or CD/DVD-ROM as your 1st Boot Device. Save changes and exist BIOS menu.


    Step> 4 After that let's boot your computer from Anvi Rescue Disk.

    Restart your computer. After restart, a message will appear on the screen: press any key to enter the menu. So, press Enter or any other key to load the Anvi Rescue Disk

    please selected your preferred language and press Enter to continue.



    Image

    Step> 5Now you are in the mini Operating system, please double click Rescue tool to start Anvi Rescue disk.


    Image

    Step> 6 Make sure that your computer is connected to network connection before you run a scan on your computer. If you fail to connect your computer to Internet, please check the tutorial on network configuration in this article: Remove Ransomware using Anvi Rescue Disk-Network Troubleshooting Tips

    Image


    Step> 7 Please run a full scan by clicking the “Scan Computer” button in the middle of the program to detect and kill the PC lockup virus.


    Image

    Step>8 Clicking “Fix Now” to Remove the detected threat by Anvi Rescue Disk.

    Image

    Step> 9 Switch to Repair tab. Scan and fix the registry error with the “Repair” module of Anvi Rescue
    Disk.

    Image

    Important Notice: You must repair the registry error after kill the virus. You are probably disabled to boot your Windows without fixing registry damaged by the virus.


    Step>10 Now your computer should be clean and rescued from the virus infection. Please restart your computer into the normal Windows mode.

    Please note, some ransomware infection variant is seriously persistent, so you are highly recommended to download the antimalware Anvi Smart Defender in the rescue disk menu when the scan and repair is finished just as shown in below picture:

    Image

    In the prompt window, click Yes button to download and install Anvi Smart Defender and perform a full scan to ensure all possible files of the infection is removed.

    To prevent the computer from infecting by such ransomware or related Trojans, please ensure you get proper protection on your computer and you may just keep the Anvi Smart Defender for this. Safe and direct download link: http://www.anvisoft.com/software/asd/

Recommended: After the virus removal, you may also need to clean up the computer operation system thoroughly using a system booster or cleaner/optimizer as whatever you may call it, like Cloud System Booster, in order to make it better perform. A nice try of Cloud System Booster by safely and directly download it here: www.anvisoft.com/software/csb/


__________________________________________________________

Protect Your Computer from Royal Canadian Mounted Police Virus and Other Similar Attack

You may keep the Anvi Smart Defender onto your computer for an extra layer of online safety. The Anvi Smart Defender Pro is focused on malware detecting, removing and preventing and its attached database is automatically updated on daily basis to ensure our user are protected from the emerging malware threats of all kinds, let alone the smart engine for light smart defending strategies. Get it now.

Or at least you should just turn on the security settings of your browser in order to better secure your online activities. See detailed instructions to turn on security features of IE, Firefox and Google Chrome.

Good luck and be safe online.
Imagination is more important than Knowledge!
User avatar
Sophia
Anvisoft Staff

Anvisoft Staff
 
Posts: 589
Joined: 2012-04-16 3:32

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby dua » 2013-02-24 13:45

Hi

I got infected by this virus yesterday (dell laptop with window Vista).

I followed the steps posted here and every step seems worked well. I burned USB, booted into Anvi, connected to web, scan found Cloud.VM.6#### (I didn't record the exact number but it was somewhat different from 60349), then fixed and repaired. However, when restarted PC, the RCMP virus still takes over.

Does this mean the virus has evolved into a new version and you need to update the virus killer?

Thanks for your help
dua
Member

Member
 
Posts: 4
Joined: 2013-02-24 13:27

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby dua » 2013-02-24 15:48

Hi Sophia,

After my last posting (ie after my first scan), I repeated the scan with "Anvi Rescue Disk" on USB. This time no virus was found. However, when I rebooted at safe mode, the safe mode was still hijacked by this virus and got shut down. Then, it was auto restarted into the normal mode and ended on the same RCMP/ICSPA ransom page.
dua
Member

Member
 
Posts: 4
Joined: 2013-02-24 13:27

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby Ivy » 2013-02-24 22:16

dua wrote:Hi Sophia,

After my last posting (ie after my first scan), I repeated the scan with "Anvi Rescue Disk" on USB. This time no virus was found. However, when I rebooted at safe mode, the safe mode was still hijacked by this virus and got shut down. Then, it was auto restarted into the normal mode and ended on the same RCMP/ICSPA ransom page.


Hello,

We apologize for any problem. I am Ivy and I am going to help you with your problem.

It seems that the Anvi Rescue Disk successfully detected and removed the virus file, but after you reboot into normal mode, you still have the ICSPA virus on your computer. Please follow steps below to fix the ransomware virus.

Step1, Boot into Anvi Rescue Disk menu.

Step2. Run full scan with Anvi Rescue Disk and delete any threats it detects. (Since you have finished the step2 and step3, please go to Step 5 directly)

Step3. Scan and repair any possible registry problem and errors.

Step4. Please keep in Anvi Rescue menu and download Anvi Smart Defender.

Step5. Run full scan with Aniv Smart Defender to kill any possible threats.

Step6. Run "Registry Fix" of Anvi Smart Defender to fix the registry problem.

Please note that the registry fix is for Pro function, you can purchase a license code to upgrade the program, or you can also get a free license code with your clean computer.

Tips on how to get trial license code:

On the top page of "Upgrade to Professional Version", there is an entrance for you to get a free license code for Anvi Smart Defender. Double clicking on the entrance button, you will be prompted to a window that allows you to get a trial license code.


Please enter a valid email address in the blank and click get now. A confirmation link will be sent to the E-mail address you provided. You need go to your email box for further information about the license code.
Anvisoft--A leading Internet security solutions provider
User avatar
Ivy
Anvisoft Staff

Anvisoft Staff
 
Posts: 2413
Joined: 2012-01-16 21:05

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby dua » 2013-02-25 9:44

Hi Ivy,

Step4. Please keep in Anvi Rescue menu and download Anvi Smart Defender.
Step5. Run full scan with Aniv Smart Defender to kill any possible threats.

The instruction in the original post is very clear and easy to follow. I did downloaded "Anvi Smart Defender". However, I don't know how to install and run it within the "Anvi Rescue Disk" boot mode. Could you provide some detailed instructions?

Many thanks
dua
Member

Member
 
Posts: 4
Joined: 2013-02-24 13:27

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby Ivy » 2013-02-25 20:51

Hi Ivy,

Step4. Please keep in Anvi Rescue menu and download Anvi Smart Defender.
Step5. Run full scan with Aniv Smart Defender to kill any possible threats.

The instruction in the original post is very clear and easy to follow. I did downloaded "Anvi Smart Defender". However, I don't know how to install and run it within the "Anvi Rescue Disk" boot mode. Could you provide some detailed instructions?

Many thanks


Hello,

I apologize for any problem.

First, you should boot your computer and configure your computer to boot from USB drive/DV/DVD that recorded Anvi Rescue Disk.

After you enter Anvisoft Rescue Disk menu and your computer connected to Internet, you can download and install Anvi Smart Defender to kill leftover threats.
Anvisoft--A leading Internet security solutions provider
User avatar
Ivy
Anvisoft Staff

Anvisoft Staff
 
Posts: 2413
Joined: 2012-01-16 21:05

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby dua » 2013-02-27 17:11

Hello,

I apologize for any problem.

First, you should boot your computer and configure your computer to boot from USB drive/DV/DVD that recorded Anvi Rescue Disk.

After you enter Anvisoft Rescue Disk menu and your computer connected to Internet, you can download and install Anvi Smart Defender to kill leftover threats.


Hi Ivy,

I did perform:
(1) boot from USB drive that recorded Anvi Rescue Disk.
(2) enter Anvisoft Rescue Disk menu and your computer connected to Internet
(3) download Anvi Smart Defender

However, I don't know how to perform the following steps within "Anvi Rescue Disk" boot mode
(4) install Anvi Smart Defender
(5) launch Anvi Smart Defender, then do an update and scan

Coiuld you provide some detail instructions on how to install and launch "Anvi Smart Defender" within "Anvi Rescue Disk" boot mode?

Thanks
dua
Member

Member
 
Posts: 4
Joined: 2013-02-24 13:27

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby Ocean » 2013-02-27 21:36

dua wrote:
However, I don't know how to perform the following steps within "Anvi Rescue Disk" boot mode
(4) install Anvi Smart Defender
(5) launch Anvi Smart Defender, then do an update and scan


Hello,

Please find Anvi Smart Defender setup package, double click on it to install> click on the curved double arrows on top right of the interface to update ASD’s malware database to the latest version> Click on Scan> Select Full Scan> Wait the scan to complete> Click the Clean button to remove all threats found. :idea:

threats found.jpg


If you have any further question, please come back to us.
User avatar
Ocean
Anvisoft Staff

Anvisoft Staff
 
Posts: 283
Joined: 2012-01-04 4:35

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby CaroCo4 » 2013-04-21 16:10

Hi there,

I can't seem to access the boot menu or BIOS on my computer. I've tried all of the F keys, as well as SPACE and DEL, and nothing comes up like described in step 3. I am running Windows Vista and the laptop is an LG R405. Any suggestions on how I can access the boot menu?

Thanks.

-Caroline
CaroCo4
Member

Member
 
Posts: 8
Joined: 2013-04-21 16:03

Re: How to Remove Royal Canadian Mounted Police Ukash Virus (ICSPA Ransomware Removal Guide)

Postby Ivy » 2013-04-21 20:35

Use the Delete or F2 keys, to load the BIOS menu. The keys F1, F8, F10, F11, F12 might be used for some motherboards, as well as the following key combinations:
Ctrl+Esc
Ctrl+Ins
Ctrl+Alt
Ctrl+Alt+Esc
Ctrl+Alt+Enter
Ctrl+Alt+Del
Ctrl+Alt+Ins
Ctrl+Alt+S

Information how to enter the BIOS menu is displayed on the screen at the start of the OS boot:

boot screen.png


In the BIOS settings on the Boot tab, select loading from a Removable Drive (you can find more detailed information in the documentation to the motherboard installed on your computer).
Anvisoft--A leading Internet security solutions provider
User avatar
Ivy
Anvisoft Staff

Anvisoft Staff
 
Posts: 2413
Joined: 2012-01-16 21:05

Next

Return to Malware Removal Guide

Random Threads
ThreadThread StarterViews
(ICSPA) International Cyber Security Preotection Viruspeterk9529
How to Remove International Cyber Security Protection Alliance Virus (ICSPA Ransomware Removal Guide)Sophia47711
How to Remove AFP ICSPA Virus (Ransomware Removal Guide)Sophia27549
How to Remove FBI CyberCrime Division virus (ICSPA Scam Removal Guide)Sophia59817
How to Remove FBI and ICSPA "Votre ordinateur a été verrouillé" Virus?(Ransomware Removal Guide)Frances5914

Who is online

Users browsing this forum: Google Adsense [Bot]

cron