How to remove Cyber Police ransomware virus

Cyber Police ransomware makes files inaccessible and asks to pay the ransom

Cyber Police ransomware is a file-encrypting virus that appends .locked file extension to the encrypted files. The virus is based on HiddenTear open source code.^[1] Thus, it uses AES cryptography to encrypt data on the targeted device. Once it’s done, the virus changes computer’s wallpaper and downloads READ_IT.txt file on the desktop.

Cyber Police virus targets the most popular file extensions, including .doc(x), .xls(x), .pdf, .png, etc. Additionally, it might delete Shadow Volume Copies^[2] by executing vssadmin.exe delete shadows /all /Quiet command. Thus, this feature makes data recovery using third-party software complicated.

Following data encryption, the virus delivers a ransom note that claims that victim’s computer has been blocked by Cyber Police “for unlicensed software’s usage.” In order to solve the problem, users are asked to pay $100 in Bitcoins. You can read the full text of the ransom note below:

YOUR COMPUTER IS BLOCKED BY CYBER POLICE
FOR UNLICENSED SOFTWARE’S USAGE
Your documents, photos, databases and other important files have been encrypted with strong encryption and unique key, generated for this computer. The private decryption key is stored on a secret internet server and nobody can decrypt your files until you will pay fine and then obtain the private key.
HOW TO PAY
Go to http://www.localbitcoins.com and buy Bitcoins worth of 100$ with your favorite payment method. Then through your account, send Bitcoins worth about 100$ to our Bitcoin address: [deleted] and indicate your email to receive the private decryption key via your email.

We want to point out that this alert is not sent by any law enforcement agency. It’s a criminals’ trick to swindle the money from naive computer users. However, transferring the money might just expand your loss. You might not only lose your data but money as well. Authors of Cyber Police ransomware are not reliable and might not provide working decryption key.

Additionally, there’s still hope that files are decryptable with HiddenTear decryptor. Therefore, you should remove Cyber Police malware from the computer and give this free tool a try. If some of the files remain inaccessible due to the .locked file extension, you can try additional recovery methods presented at the end of the article.

However, before you start data recovery procedure, you have to get rid of the virus. We recommend using FortectIntego for Cyber Police removal. However, you can use other security software too. But please, do not try to delete virus-related components manually!

Strategies used for spreading the crypto-malware

The majority of ransomware-type cyber threats spreads using the same methods, such as:

• malicious spam emails,
• malvertising,
• bogus software updates or downloads,
• illegal downloads,
• exploit kits.

The Cyber Police malware is most likely to enter the system with the help of obfuscated email attachment. Usually, it is presented as a legit document, but actually, it includes malware payload. Once the infected file is opened, the executable is downloaded on the system.

Security experts from Die Viren^[3] also warn that users should be careful with all clickable content online. Ads, links, and downloads might be dangerous. Thus, you should always make sure that the content you want to watch, download or play is legit and can be trusted. If you don’t watch your steps online, even the best security software won’t protect you from ransomware attack.

Deletion of the Cyber Police ransomware virus

Security experts do not recommend manual Cyber Police ransomware removal. The virus might inject malicious code into a legit process or install numerous harmful files to the system. Thus, you might accidentally delete wrong files and damage the system even more.

In order to remove Cyber Police ransomware safely, you should run a full system scan with FortectIntego, MalwarebytesMalwarebytes or another malware removal tool. However, if the virus blocks access to the security software, you should check the guide below and solve the problem.