Fake Police Central e-crime Unit (PCeU)

Updated: August 6, 2012 Rogue 18 Comments

On this page is removal guide for ransom software called Police Central e-crime Unit using effective and free tool. This malware uses a rootkit techniques, so booting on a removable USB drive is required.

PCeU stands for Police Central e-crime Unit. This is an Internet scam that will lock the computer and demands for a fake key in order to unlock the system. Police Central e-crime Unit (PCeU) will pretend to that watch activities of every user. In fact, it will trick you by telling that you are involved in visiting explicit web sites including pornographic and other similar pages. The fake software will order you to pay a fine of 100 pounds. This coincides with the locking of your desktop. PCeU uses Ukash and Paysafecard for its online payment transaction.

Typically, Police Central e-crime Unit will spread on the Internet in different methods. You may catch this fraud by visiting malicious web sites or downloading infected files from peer-to-peer network servers. Additionally, PCeU can be obtained from links sent out via spam email messages and hacked instant messenger accounts.

The moment its get inside the computer, it initiate a code to lock the system and display the fake message as if it was a valid alert from Specialist Crime Directorate of United Kingdom. The message will attempt to scare you. It states that you committed a violation for visiting adult web sites. Moreover, it also states that several explicit videos and similar illegal contents are present on your computer.

We are publishing this article to remind you that Police Central e-crime Unit (PCeU) is part of fraud online activity. Its goal is to scare computer users and obliged them to pay the ransom. Messages it projects are misleading. You must remove this malware as soon as possible without compensating the authors behind the attack. Download and scan with legitimate security product as you can find on the procedures below.

Screenshot Image of Fake Police Central e-crime Unit (PCeU):

Fake Police Central e-crime Unit

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

How to Remove Fake Police Central e-crime Unit (PCeU)

Download Kaspersky Rescue Disk

1. Download the ISO image of Kaspersky Rescue Disk 10 (kav_rescue_10.iso) from this link.
2. Download the Kaspersky Rescue Disk Maker (rescue2usb.exe) from this link.

Create A Bootable USB Drive

3. Insert a clean USB flash drive to available slot. To record the ISO file and create a bootable USB drive, double-click on rescue2usb.exe. It will extract the files and create a folder called Kaspersky Rescue2Usb.

4. Kaspersky USB Rescue Disk Maker should run after the extraction. If not browse the Kaspersky Rescue2Usb folder and run the rescue2usb file.
5. From Kaspersky USB Rescue Disk Maker console, click on Browse and locate the file kav_rescue_10.iso.

Kaspersky Rescue Disk Maker

6. On USB Medium, select the USB drive you wanted to make as bootable Kaspersky USB Rescue Disk. This will become a bootable virus scanner.
7. Click in Start to begin the process.
8. When the process is complete, it will display a notification message. Your tool to remove Fake Police Central e-crime Unit is now ready.

Rescue Disk Created

Boot The Computer From The USB Kaspersky Rescue Disk 10

9. Since Fake Police Central e-crime Unit uses a rootkit Trojan that controls Windows boot functions, we need to reboot the computer and select the newly created Kaspersky USB Rescue Disk as first boot option. On most computers, it will allow you to enter the boot menu and select which device or drives you wanted to start the PC. Refer to your computer manual.
10. If you successfully enters the boot menu, choose the USB flash drive. This will boot the system on Kaspersky Rescue Disk. Press any key to enter the menu.

Kaspersky Rescue Disk 10 Menu

11. If it prompts for desired language, use arrow keys to select and then press Enter on your keyboard.
12. It will display End User License Agreement. You need to accept this term to be able to use Kaspersky Rescue Disk 10. Press 1 to accept.
13. The tool will prompt for various start-up methods. We highly encourage you to choose Kaspersky Rescue Disk Graphic Mode.

Remove Fake Police Central e-crime Unit Using Windows Unlocker

14. Once the tool is running, you need to run WindowsUnlocker in order to delete registry that belongs to Police Central e-crime Unit. On start menu located at bottom right corner of your screen, select the K icon or select WindowsUnlocker if it is present on the Menu.
15. This utility will start removing any components that blocking you from accessing the computer. It will display a log file containing actions performed on the infected computer like deleted infected file and removed registry entries.
16. After removing components of Police Central e-crime Unit. You need to scan the system using the same tool. On start menu, select Kaspersky Rescue Disk.

Kaspersky Rescue Disk Scanner

17. Be sure to update the program by going to My Update Center tab. Click on Start update. 18. After the update, go to Object Scan tab and thoroughly scan the computer to locate other files that belong to Fake Police Central e-crime Unit. 19. Restart the computer normally when done.

Encrypt files affected by Fake Police Central e-crime Unit (PCeU)

Execute this step if the ransom program has encrypted some files in your computer. This tool will try to calculate decryption key automatically. On some instances, it will require you to indicate path to at least one affected file. To run the tool, please follow these steps:

1. Download RannohDecryptor from this page. Save the file to any convenient location on your hard drive.
2 . Once downloaded, locate the file. It is RannohDecryptor.exe.
3. Double-click on the file to launch the program. Upon initialization, it checks for needed update, thus Internet connection is required at this point.

RannohDecryptor

4. If you want to delete encrypted files instantly after the tool decrypts it, click on Change parameters. Tick the line that says, “Delete crypted files after decryption”.

Note: We suggest keeping the file for a while just in case something went wrong with the decryption process.

5. Click on Start scan to begin looking for files encrypted by Fake Police Central e-crime Unit (PCeU). If it prompts you to locate sample file, kindly browse to appropriate location and submit one encrypted file. The tool will proceed with the scan and automatically encrypts affected files.

Alternative Removal Method for Fake Police Central e-crime Unit (PCeU)

Option 1 : Use Windows System Restore to return Windows to previous state

If Fake Police Central e-crime Unit (PCeU) enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Fake Police Central e-crime Unit (PCeU) infiltrates the PC, we highly encourage you to execute this procedure if none of the above works. You may proceed with Windows System Restore, click here to see the full procedure.