ICSPA Virus

Posted by Max Lehmann on February 12, 2013

What is ICSPA Virus?

ICSPA Virus is a computer threat that is classified as ransomware infection. It means that it holds your computer hostage and then demands a ransom fee for unlocking your desktop. There are many versions of this infection, localized for different countries. Each of the ICSPA Virus features a logo of the local police authorities, but the common thing is the International Cyber Security Protection Alliance logo on the right side of the notification. Hence the name of the infection - ICSPA virus. Despite the fact, that everything looks legitimate, there is no connection between ICSPA Virus and law enforcement authorities in various countries.

Where does ICSPA Virus come from?

ICSPA Virus is distributed by Urausy trojan. This Trojan can enter your system via fake updates and codecs. For example, the Firefox need to update immediately Virus is a fake alert on Firefox browser that has an "update" button embedded and is directly related to Urausy trojan. Therefore, clicking the button automatically makes you a subject to the infection of ICSPA Virus or any other ransomware from the Urausy group or Ukash virus family, for example, FBI Cybercrime Division Virus, Royal Canadian Mounted Police Virus, United Kingdom Police Virus and many more. All of them display very similar notifications that contain the following information:

ATTENTION! Your PC is blocked due to at least one of the reasons specified below.

You have been violating "Copyright and Related Rights Law" (Video, Music, Software) and illegally using or distributing copyrighted content, thus infringing Article 128 of the Criminal Code of [country].

Fines may only be paid within 72 hours after the infringement. As soon as 72 hours elapse, the possibility to pay the fine expires, and a criminal case is initiated against you automatically within the next 72 hours!

The amount of fine is [currency] 100. You can pay a fine Ukash or PaySafeCard.

What to do with ICSPA Virus?

Obviously, you have to remove ICSPA Virus from your computer ASAP. The ransom fee can differ from 100 euro to 100 pounds and 100 USD, depending on your location, but it is important that you do not use the alternative payment systems (Ukash or PaySafeCard) to transfer the money, because ICSPA Virus will not unlock your computer, not matter how much money you send. It is not an official applicatio nof a law enforcement authority, so it does not live up to its promises.

To unlock your computer and subsequently remove ICSPA Virus from your PC, follow the instructions below:

Windows Vista & Windows 7

  1. Reboot the PC and tap F8 repeatedly until Advanced Boot Options menu appears.
  2. Use arrow keys to navigate and Select Safe Mode with Networking. Press Enter.
  3. Go to http://www.anti-spyware-101.com/download-sph and download SpyHunter.
  4. Install SpyHunter and perform a full system scan.

Windows XP

  1. Restart the computer and press F8 repeatedly once BIOS screen loads.
  2. Select Safe Mode with Networking and press Enter.
  3. When a confirmation dialog box appears, press Yes.
  4. Download SpyHunter.
  5. Open Start Menu and launch Run.
  6. Type "msconfig" and press Enter.
  7. Click Startup tab on System Configuration Utility.
  8. Click Disable All and click OK to save changes.
  9. Restart the PC in Normal Mode.
  10. Install the program downloaded and launch a full system scan.

Invest in the antimalware tool if necessary, to remove ICSPA Virus for good. Leave us a comment below, if you have any question about this infection.

100% FREE spyware scan and
tested removal of ICSPA Virus*
ICSPA Virus
Disclaimer
Disclaimer
Malware
  1. Craig April 23, 2013 at 5:47 pm

    Every time i follow your direction to start-up in safe mode network it goes through everything and end up on the virus page. It does not allow a stop point to download anything. Can i ask for help?

    Reply
    • Max Lehmann Max April 24, 2013 at 6:54 am

      Hello Craig,

      Some versions block Safe Mode with Networking, so in this case I suggest to use Safe Mode with Command promt but this is a little bit more difficult to remove:

      1.Restart Computer in Safe Mode with Command Prompt.
      2.Run Regedit
      3.Now Search for WinLogon Entries. There will be a key labeled Shell. Replace them with explorer.exe or it should be blank.
      4.Search registry for ICSPA Virus files and remove them.
      5.Try to reboot into normal mode and scan with Spyhunter.
      6.If this fails, try doing system restore (rstrui.exe) from safe mode with command prompt.

      Good Luck

      Reply
      • Bob June 10, 2013 at 2:39 am

        Max, I’m having the same problem, I tried that before, spyhunter needs internet access to install, any other ideas? thanks

        Reply

Leave a Comment

Enter the numbers in the box to the right *