SOPA virus: what the fake anti-piracy lock screen is and how to remove it
The SOPA virus is a fake anti-piracy lock screen that says your IP address is on a black list and demands 200 dollars or euros in 72 hours. The fine is not real, so do not pay: Safe Mode or Microsoft Defender Offline gets you past the lock, and some sources say it also encrypts files.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A free scan looks at startup items and programs that screen lockers use to return.
Do it yourself · free Remove SOPA virus yourself 4 steps, about 12 minutes, no software needed.
Start the steps
SOPA virus: summary
| Type | Fake anti-piracy lock screen (police-style ransomware); file encryption reported but not confirmed |
|---|---|
| Risk | Medium: a scam you can remove; files may be encrypted; possible extra malware |
| Symptoms | A full-screen "Stop Online Piracy Automatic Protection System" window with a 200 dollar fine, a voucher box and a 72-hour warning |
| How to get rid of it | Safe Mode or Microsoft Defender Offline, then a full scan; never pay |
| Our check | Desk check on 5 October 2026: our screenshot, PCrisk, TorrentFreak and official records; no live sample run |
| First seen | October 2012 (TorrentFreak); our guide 12 April 2021 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 12 more facts
| Name | SOPA virus (Stop Online Piracy Automatic Protection System, S.O.P.A. ransomware) |
|---|---|
| Encrypted file extension | Not confirmed: we found none |
| Ransom note | A full-screen window; it also mentions a warning.txt. The wording is quoted below |
| Decryptor | None found; not confirmed. No More Ransom lists decryptors if your files carry a new extension |
| Contact | An e-mail address at a sopasystem domain is on the screen; do not write to it |
| Detection names | Microsoft: no Microsoft detection name is known for it (we searched the Microsoft Security Intelligence names). No other vendor name confirmed |
| Distribution | Spam e-mail attachments with macros, freeware and shareware (our 2021 guide) |
| Damage | PC locked until removed; possibly encrypted files; paid money lost |
| Evidence | One write-up by a security site; details still limited |
| Lock screen claims to be | Stop Online Piracy Automatic Protection System |
| Free decryptor | No free decryptor is known (checked 5 October 2026) |
| Facts checked | 5 October 2026 |
Desk check on 5 October 2026 against our 2021 screenshot, PCrisk, TorrentFreak, Congress.gov and official records on police-style ransomware. No live sample was run, and file encryption is not confirmed.
What the SOPA virus is and how the lock works
The SOPA virus is a fake "anti-piracy" lock screen. It names the Stop Online Piracy Act, says your IP address is on a "black list" and asks for 200 dollars or euros. The accusation is invented, and the one thing the sources disagree on is whether it also encrypts files.
- 1
It reaches the PC
Our 2021 guide named spam e-mail and free software. The mail pretends to be an order or delivery notice from a company such as DHL, eBay or FedEx, with a Word, Excel or PDF file laced with a malicious macro that drops the payload when opened. We saw no live sample, so the exact first step is not confirmed.
- 2
It locks the screen at restart
Our guide said the system is locked once the user reboots the computer, so the infection cannot be missed. A full window titled "Stop Online Piracy Automatic Protection System - Your computer is locked!" covers the desktop.
- 3
It says you broke the law
The text lists three accusations: sharing audio or video protected by copyright, sharing illegal content, and sharing copyrighted software. It cites the bill by its number, H.R. 3261, and says your PC and files are blocked.
- 4
It asks for 200
US and Canadian victims are told to buy a MoneyPak prepaid voucher worth 200 dollars; everyone else is told to send 200 euros by Western Union. A box takes the voucher number and an e-mail address, and a red line gives 72 hours.
- 5
It threatens to erase the data
The warning says all computer data will be erased if the fine is not paid in 72 hours. We found no sign that this deadline is anything but pressure.
- Kind of threat
- Fake anti-piracy lock screen (police-style ransomware); PCrisk and a 2012 report add that it encrypts files
- Name on the screen
- Stop Online Piracy Automatic Protection System, S.O.P.A.
- Demand
- 200 US dollars (USA and Canada) or 200 euros (rest of the world)
- Deadline
- 72 hours, then "all your computer data will be erased"
- Earliest report we found
- October 2012 (TorrentFreak, 11 October 2012)
Our 2021 guide likened it to the FBI virus and the Celas virus and called it a member of a Ukash virus group. The likeness to other police-style lockers holds, but Ukash was a payment voucher, not a malware family, so that wording is corrected here.
A short history of the SOPA lock screen
2011-2012
The bill the name copies
H.R. 3261, the Stop Online Piracy Act, was introduced in the US House in 2011. Public protests and an internet blackout in January 2012 ended it; Congress.gov still lists it as Introduced.
2012
Police-style lockers spread
The FBI reported in 2012 that Reveton locked computers in the name of law enforcement and demanded voucher payment. The SOPA screen uses the same recipe.
October 2012
"SOPA is back"
TorrentFreak reported on 11 October 2012 that a virus maker had resurrected the bill as a ransomware, warning victims about a black list and a 72-hour deadline. It quoted a report that files were encrypted.
February 2015
MoneyPak closes
Green Dot closed its MoneyPak voucher, the payment method the screen asks for in the USA and Canada.
April 2021
Our original guide
We published a short guide with the screenshot below. It said the virus locks the screen and may also encrypt files.
The lock screen as our 2021 guide showed it: a Stop Online Piracy Automatic Protection System banner, a blue box about a "S.O.P.A. Black List", three payment steps, a MoneyPak voucher and e-mail box, a question-and-answer panel and a red 72-hour warning. October 2026
This rewrite
We did not run a live sample. The facts come from our 2021 guide and screenshot, PCrisk, TorrentFreak and official records.
What we checked for this update
The SOPA virus is a program, not a website we can open, so there was no live site test. We say what we checked and what we could not.
SOPA virus · desk check · 5 October 2026
- Our screenshotOpened and read: the banner, the 200 dollar fine, MoneyPak box, e-mail box, 72-hour warning and the question about deciphering a file.
- The billCongress.gov lists H.R. 3261 as Introduced; it never became law.
- File encryptionClaimed by PCrisk and our 2021 guide; we saw no sample, extension or decryptor, so it is not confirmed.
- Vendor detectionWe found no Microsoft or other vendor detection name for this program.
- Live sampleNot run. Nothing here proves how a current copy behaves.
- Recent reportsNone in our comments; about 40 searches a month in the United States.
Scam; file damage not ruled out The lock screen is a bluff and the fine should never be paid. Because encryption is reported but unconfirmed, treat your files as at risk until you have tried to open them, and treat passwords as possibly exposed until a clean scan says otherwise.
How SOPA virus behaves
Why the SOPA screen cannot be real
Each claim on the screen fails a plain check.
| What the screen says | What is true |
|---|---|
| "Your IP address was included in the S.O.P.A. Black List" | The Stop Online Piracy Act (H.R. 3261) was a bill in the US Congress in 2011-2012. Congress.gov lists its status as Introduced: it never became law, so there is no list and no organisation that enforces it. |
| "Downloading child pornography, phishing software" | The same three accusations are shown to everybody and are not checked against your PC. |
| "Pay 200 within 72 hours or all data will be erased" | A deadline is a pressure tool. No authority takes a fine through a voucher number typed into a box. Whether the data is really at risk depends on whether the program encrypts files, which the next section covers. |
| "Pay with MoneyPak" | A MoneyPak code works like cash and cannot be recalled. Green Dot, the issuer, stopped selling MoneyPak in February 2015 after fraudsters flocked to it. |
Does the SOPA virus encrypt your files? What the sources say
Our 2021 guide said the SOPA virus "may also encrypt" files. PCrisk says it does. We could not confirm it ourselves, so this page treats the files as at risk.
| Source | What it says | What we make of it |
|---|---|---|
| Our 2021 guide | SOPA "has been found to encrypt the files" and offers to decrypt a file sent to the criminals | Kept, but the guide gave no source or file extension |
| PCrisk (updated December 2024) | All files are encrypted; the authors offer to "test" decryption on one file; PCrisk says it did not fully analyse the program | The strongest source we found, but it admits it is incomplete |
| TorrentFreak, 11 October 2012 | "Holds all files on the host computer ransom"; payment promised to free the data | Repeats the screen's claim; it does not say how the files were checked |
| The screen itself | Questions and answers offer to decipher "one ciphered file" sent by e-mail as proof | Shows the criminals expect encrypted files, but proves nothing about your PC |
So the safe reading is: it is a screen locker for certain, and it may be a file encryptor too. We know of no file extension it adds, no decryptor, and no ransom note other than the lock screen and the "warning.txt" it mentions. All three are marked not confirmed in the summary table.
- 1
Check the files before you do anything else
If you can still reach the desktop or Safe Mode, try to open one document and one photo. If they open as before, you have a locker only.
- 2
If they will not open
Look at the file name for a new ending. Copy one small unopenable file and the warning.txt, if it exists, to a USB stick. Do not delete or rename anything.
- 3
Identify it from another device
Upload the file and the note to ID Ransomware or search the name on No More Ransom from a clean device. We have not found a decryptor for SOPA there, and we cannot say a tool exists.
- 4
Do not send a file to the criminals
The e-mail address on the screen is theirs. Removing the lock does not decrypt anything; a clean backup is the real way back.
The same recipe under other badges
Only the name changes between police-style lockers: an official badge, an invented crime, a voucher box. These three come from our archive and are not SOPA.
The SOPA virus ransom note
Stop Online Piracy Automatic Protection System. Your computer is locked!
If you see a warning.txt or warning screen, it means your IP address was included in S.O.P.A. Black List.
Downloading or distributing audio or video files protected by Copyright Law.
As a result of these infringements based on Stop Online Piracy Act (H.R. 3261) your PC and files are now blocked.
WARNING!!!: If you don't pay the fine within 72 HOURS at the amount of 200 USD, all your computer data will be erased
How to remove SOPA virus
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove the SOPA virus lock screen
Your files are not encrypted.
The steps get you past the lock screen first, then remove what starts it.
Step 1: Get past the lock screen
A screen locker does not encrypt files; it only covers the desktop. On the sign-in screen, hold Shift, click the power icon and choose Restart, then Troubleshoot > Advanced options > Startup Settings > Restart, and press 5 for Safe Mode with Networking.
The locker usually does not start in Safe Mode, so you can remove it from startup and scan.
Ignore any fine it demands in the name of Stop Online Piracy Automatic Protection System: no police force or company locks a PC to collect payment. The route is the same in Windows 11 and Windows 10.
Full procedure with screenshots: Start Windows or a Mac in Safe Mode On uGetFix
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after SOPA virus, its publisher or created on the day the problem started.Delete those folders, and check
C:\Program FilesandC:\Program Files (x86)too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of SOPA virus that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Report it and recover your files
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
How to prevent SOPA virus and the next attack
Both routes our 2021 guide named are habits you can change.
Do
- Check the sender, grammar and the reason for a message before opening an attachment
- Keep Windows, Office and the browser updated
- Download software only from the maker's own site
- Follow the 3-2-1 backup rule: three copies, two kinds of storage, one kept offline, and test one restore
- Use a VPN on public networks to hide your address; it does not stop malware
Don't
- Open an order or shipping notice you did not expect, or enable macros because a document asks
- Install freeware or shareware from unknown sites
- Believe a screen that says an organisation can see your IP address
- Type a voucher number or an e-mail into a lock screen
- Plug a backup drive into a PC that is not clean
Questions about SOPA virus
How do I open my .docx and .jpg files after the SOPA virus locked my PC?
Open them as you always did if the lock screen is all there is, because most police-style lockers do not touch files. Documents and photos keep their names, such as .docx and .jpg. Get past the lock first with Safe Mode, Microsoft Defender Offline or System Restore, then try one file.
Our 2021 guide and PCrisk say the SOPA virus may also encrypt files, which we could not confirm. If a file will not open or has a new ending, copy it to a USB stick and check the name on No More Ransom from a clean device.
Is there a decryptor for the SOPA virus?
We found none and cannot confirm that one exists. PCrisk lists no decryptor, and we saw no file extension to search by. If your files do carry a new ending, upload the note and a small encrypted file to ID Ransomware and check nomoreransom.org from a clean device; that shows whether a tool exists.
Be careful with pages that promise to decrypt for a fee, and never send a file to the e-mail address on the lock screen, since it belongs to the criminals.
Should I pay the SOPA virus ransom or fine?
No, never pay. The 72-hour deadline is pressure: the screen says all data will be erased, but nothing we read shows that it happens. A voucher payment cannot be recalled, Microsoft says paying guarantees nothing, and the MoneyPak system the screen asks for was closed in 2015.
The unlock code the screen promises is only the criminals' claim. Remove the lock with Safe Mode or Microsoft Defender Offline and scan the PC. If you did pay, tell the shop or the voucher issuer quickly and change your passwords from a clean device.
Do paid decryption services or companies that recover data work for the SOPA virus?
No, and be wary of both. The criminals' offer to decipher one file for free is a sales pitch to make you believe they can unlock everything; it also tells them your address is real. Paid recovery companies often just pay the criminals.
If your files are encrypted, check No More Ransom for a free tool, restore from a backup made before the infection, and clean the PC first, because a restored file is encrypted again on an infected machine.
How did the SOPA virus get on my PC?
Our 2021 guide named spam e-mail and free software. The e-mails pretend to be orders, shipping notices or documents from companies such as DHL, eBay or FedEx, with a Word, Excel or PDF attachment that carries a malicious macro. Opening it drops the payload.
Freeware and shareware from unknown sites were the other route. We saw no live sample, so we cannot say which route fits your case. Check your e-mail and your recent downloads for the likely cause.
Did the SOPA virus steal my data?
Possibly, but a lock screen alone does not prove it. We found no source that says this program steals passwords, and none that rules it out. Police-style lockers have arrived with other malware before: the FBI said Reveton was used together with Citadel, which can log what you type.
So treat a locked PC as a possible data-theft case. Change your passwords from another device, watch your bank statements, and scan the PC with Microsoft Defender Offline.
Is the SOPA virus different from other ransomware, or the same?
It differs from the best-known file encryptors in one way that matters: what you see is a fake law-enforcement notice, not a ransom note in every folder. It copies the recipe of the FBI virus and other police-style lockers. Whether it also encrypts files is where sources disagree.
PCrisk says it does; we saw no sample. Families such as Djvu or LockBit rename your files, and removing them does not bring the files back. If yours do carry a new extension, you may have both.
Will I be arrested for what the SOPA screen says?
No. The SOPA virus is a scam, and no authority has contacted you. The Stop Online Piracy Act was a bill, H.R. 3261, that Congress.gov lists as Introduced; it never became law, so no black list or enforcement body exists under that name.
The three accusations are shown to every victim, and the screen only repeats an IP address to look convincing. Keep a photo for a report, and if you are worried, call your local police on their normal number.
Will Fortect remove SOPA virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For SOPA virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Our 2021 guide to the SOPA virus (old version of this page) (read October 5, 2026)
- PCrisk: Stop Online Piracy Virus, updated 9 December 2024 (read October 5, 2026)
- TorrentFreak: SOPA Is Back! ... As a Ransomware Virus, 11 October 2012 (read October 5, 2026)
- Congress.gov: H.R.3261, Stop Online Piracy Act, 112th Congress (read October 5, 2026)
- FBI: New Internet Scam (Reveton ransomware locks computers, demands payment), 9 August 2012 (read October 5, 2026)
- Digital Transactions: Green Dot Continues Clawing Back From Its MoneyPak Closure, 5 November 2015 (read October 5, 2026)
- Europol: Police dismantle prolific ransomware cybercriminal network (read October 5, 2026)
- Microsoft Learn: Run and review the results of a Microsoft Defender Offline scan (read October 5, 2026)
- Microsoft Support: Windows startup settings (read October 5, 2026)
- No More Ransom (read October 5, 2026)