International Cyber Security Protection Alliance virus removal tool

andy | February 16, 2013

In advance we’d like to say that International Cyber Security Protection Alliance is not a virus, of course. Regretfully, this is the way some users tend to think about this decent organization. The reason for such unfair judgment is because hackers use International Cyber Security Protection Alliance and its logo (ICSPA) in their many ransomwares that they’ve developed. There is quite a large number of such ransomware lockers today, and all of them belong to the Urausy virus family (who knows why exactly such family is called).

International Cyber Security Protection Alliance virus

When International Cyber Security Protection Alliance ransomware attacks computers they immediately become totally locked. There’s no any easy solution that one might undertake to unblock the PC. Simple rebooting of the system doesn’t help. The same locked status actually persists, no matter how many times the reboot is done. The keyboard is disabled as well, giving no other options for users but to perform a hard reset.

The ICSPA virus accuses users of performing various crimes online, such as sending unsolicited spam to various addresses, downloading, using and spreading illegal software, audio and video, watching extremely explicit sinful content, etc. The fact is that in the majority of the cases users have never done such things. Yet, the message supposedly coming from ICSPA accuses them of doing such things and instructs to pay the fine, which is quite a large amount of funds.

Please don’t pay any money (ransom) via Ukash, Paysafecard or GreenDot MoneyPak payment system as instructed by the crooks. Once again, this is a fake warning from ICSPA. It has nothing to do with this agency, in fact. It is the direct product of cyber hackers who want to become richer by means of deceiving and tricking simple and trusting users. Please follow the removal guide to delete this ransomware as explained below.

Ransomware unlocking procedure

Note! This tutorial is effective for all GreenDot MoneyPak, Ukash and Paysafecard ransomwares.

  1. Restart your computer and press F8 while it is restarting.
  2. Choose safe mode with networking.
  3. safe mode with networking

  4. Press Start menu and select Run, or press [Win]+R on keyboard.
  5. Run command

  6. Type msconfig
  7. msconfig

  8. Disable startup items rundll32 turning on any application from Application Data.
  9. Restart your system once again.
  10. Scan your system with GridinSoft Trojan Killer to identify file and delete it.

Some versions of these viruses disable all safe modes, but give a short gap that you can use to run anti-malware programs. Then do following:

  1. Reboot normally.
  2. Click Start and choose Run.
  3. Enter the text specified in the quotation below. If malware is loaded, just press Alt+Tab once and keep entering the string blindly then press Enter.
  4. http://trojan-killer.net/download.php

  5. Press Alt+tab and then R (letter) a couple of times. The process of ransomware virus should be killed after you succeed to download, install our recommended software and scan your PC with it.

Download GridinSoft Trojan Killer for thorough system checkup

1 Comment

  1. Sunny says:

    I had this virus and I tried the commands written on this site but it didn’t work. I found a video on youtube that helped me. What I noticed was a mistake here.after pressing f8 you go on safe mode with command prompt.

1 Trackbacks

Leave a comment

*