ICE Cyber Crime Center Ransomware Removal Guide

  • June 6, 2013
  • 05:32 PM
  • Read 151,744 times

ICE Cyber Crime Center Ransomware Information:
Skip this and take me to the ICE Cyber Crime Center Ransomware removal options!

The ICE Cyber Crime Center Ransomware is part of the Troj/Reveton-Ransomware family and displays a lock screen that requires you to pay a ransom before you will be allowed to access your Windows desktop, applications, or files. This ransomware infections pretends to be from the Department of Homeland Security's ICE Cyber Crime Center and states that it has detected that your computer has been involved in illegal cyber activity. This activity includes the distribution of pornography, copyrighted files, or computer viruses. It goes on to state that you need to pay a fine in the amount of $300 within 48 hours. In order to send the ransom you will be required to purchase a MoneyPak voucher at a store like CVS, Walmart, or Walgreens and submit the voucher ID in the lock screen. Once they receive the money, they will then automatically unlock your screen. This ransomware will also attempt to take a picture of you via your Webcam to further scare you into sending in the ransom. Last, but not least, this ransomware infection will also delete your Windows Automatic Update service so that you are unable to automatically update Windows. As this lock screen is not a legitimate message from any government agency, please ignore it and continue reading the removal guide.

  • ICE Cyber Crime Center Ransomware screen shot

The text of the ICE Cyber Crime Center Ransomware lock screen screen is:

The ICE Cyber Crime Center
Your computer has been blocked
The work of your computer has been suspended on the grounds of unauthorized cyber activity.

Possible violations are described below:

Article -174. Copyright
Imprisonment for the term of up to 2-5 years
(The use or sharing of copyrighted files). A fine from 18,000 up to 23,000 USD

Article - 183. Pornography
Imprisonment for the term of up to 2-3 years
(The use of distribution of pornographic files). A fine from 18,000 up to 25,000 USD

Article - 184. Pornography involving children (under 18 years)
Imprisonment for the term of up to 10-15 years
(The use or distribution of pornographic files). A fine from 20,000 up to 40,000 USD

Article - 104. Promoting Terrorism
Imprisonment for the term of up to 25 years without appeal
(Visiting the websites of terrorist groups). A fine from 35,000 up to 45,000 USD

Article - 68. The distribution of virus programs
Imprisonment for the term of up to 2 years
(The development or distribution of virus programs, which have caused harm to other computers). A fine from 15,000 to 28,000 USD


To unlock your computer and to avoid other legal consequences you are obligated to pay a release fee of $300 USD.

An attempt to unlock this computer by yourself will lead to the full formatting of the operating system. All the files, videos, photos, documents on your computer will be deleted.

As you can see, this is a computer infection and not a legitimate message from the Department of Homeland Security. Therefore, ignore anything it displays and instead use the removal guide below to remove this ransomware from your computer.

ICE Cyber Crime Center Ransomware Removal Options

Self Help Guide

This guide is intended for advanced computer users only. Please ensure your data is backed up before proceeding. If you’re uncomfortable making changes to your computer, consider having a professional help clean your computer or ask in the forums.
  1. Please print out these instructions as we will need to perform most of these steps on the infected computer. You will also need a USB drive, which will have all of its data erased and will then be formatted. Therefore, only use a USB drive that does not contain any data that you need. This USB drive must also have a size of at least 32 MB.

  2. As the ICE Cyber Crime Center Ransomware infection locks you out of your computer, you will need to create a bootable USB drive that contains the HitmanPro.Kickstart program. We will then boot your computer using this bootable USB drive and use it to clean the infection so that you are able to access Windows normally again.

    In order to do this please download HitmanPro from the following link and save it to your Windows desktop.

    When you visit the above page, please download the version that corresponds to the bit-type of the Windows version you will be using to create the Kickstart USB drive.

  3. Once HitmanPro has been downloaded, please insert the USB key that you would like to erase and use for the installation of HitmanPro.Kickstart.

  4. Once the USB drive is attached to your computer, double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows). When the program starts you will be presented with the start screen as shown below.

    HitmanPro Start Screen

    Now click on the little picture of the person performing a kick as indicated by the red arrow above.

  5. This will open a screen where you will see some information on how to create the Kickstart USB drive.

    HitmanPro.Kickstart creation screen

    You should also a see a list of all USB drives that are currently attached to your computer as indicated by the blue arrow in the picture above. Select the USB drive that you would like to use and then click on the Install Kickstart button. Please note that this process will erase all of the data on the selected USB drive, so be sure to first backup any data that may be stored on it.

  6. You will now be presented with an alert stating that the USB flash drive will be erased. If you wish to proceed, click on the Yes button. Otherwise, click on the No button to cancel this process. Once you click on the Yes button, the program will begin to download the necessary files and will then install them on the USB Drive. When it has finished you can then click on the Close button to close the HitmanPro program.

  7. Now remove the Kickstart USB drive and insert it into the infected computer.

  8. Once it is inserted, turn off the infected computer and then turn it on. As soon as you power it on, look for text on the screen that tells you how to access the boot menu. This text will typically contain a key that they want you to press on your keyboard in order select the device you wish to use to boot your computer. The keys that are commonly associated with enabling the boot menu are F8, F11 or F12. You can see a screen shot of various screens that show you what key to press below.

    Various boot menu screens
    Screenshot courtesy of SurfRite.

    Once you determine the proper key that you need to press to access the Boot Menu, restart your computer again and start immediately tapping that key. Once the boot menu appears, you can select the device you wish to boot your computer from. Please select the USB drive that you have installed HitmanPro.Kickstart on and that is inserted into the infected computer.

  9. Your computer will now boot from the USB drive and automatically load the HitmanPro.Kickstart program. As it loads you will be presented with a screen asking you to select the USB boot options you wish to use.

    Kickstart USB Boot Options

    At this screen, please press 1 on your keyboard and you will see that Windows begins to start normally.

  10. When Windows starts, you should login as normal and you will once again see the screen locker for the ransomware. After about 15-20 seconds, the HitmanPro window will appear on top of the screen locker as shown in the image below.

    HitmanPro Kickstart overlayed on top of the ransomware screen

    When you see this screen, please click on the Next button to start the cleaning process.

  11. You will now be at the HitmanPro setup screen where you should make sure the option No, I only want to perform a one-time scan to check this computer..

    Kickstart Setup Options

    Once it is selected, please click on the Next button.

  12. HitmanPro will now begin to scan your computer for infections. When it has finished it will display a list of all the malware that the program found as shown in the image below. Please note that the infections found may be different than what is shown in the image.

    MalwareBytes Scan Results

    You should now click on the Next button to have HitmanPro remove the detected infections. When it is done you will be shown a Removal Results screen that shows the status of the various infections that were removed. At this screen you should click on the Next button and then on the next screen click on the Reboot button.

  13. HitmanPro will now reboot your computer and Windows should start normally. Once it has started, you should login as normal and you will find that the ransomware is no longer active and you can now access your Windows desktop.

  14. On some variants of this infection, instead of being at your Windows desktop you may be shown a Windows with a black background called the Windows Command Prompt. If that happens, click on the Windows Command Prompt and type explorer.exe and then press Enter on your keyboard.

  15. Your normal Windows desktop should now load. Once the desktop appears, open a browser and download the clean-rw.reg file by clicking on the link below. When downloading the file, please save it to your desktop.

    clean-rw.reg Download Link
  16. Once the file has been downloaded, double-click on it and when it prompts, please allow the data to be merged into the Windows Registry. This will now fix it so that the normal Windows desktop appears when you login instead of the Command Prompt.

  17. Now reboot your computer and when you next login, you should see your normal desktop.

  18. As many malware and unwanted programs are installed through vulnerabilities found in out-dated and insecure programs, it is strongly suggested that you use Secunia PSI to scan for vulnerable programs on your computer. A tutorial on how to use Secunia PSI to scan for vulnerable programs can be found here:

    How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector


Your computer should now be free of the ICE Cyber Crime Center Ransomware infection. If your current anti-virus solution let this infection through, you may want to consider purchasing the licensed version of HitmanPro to protect against these types of threats in the future.

View Associated ICE Cyber Crime Center Ransomware Files

<malware path>\<random>.exe" <malware path>\<random>.dll %AppData%\<random characters> %CommonAppData%\<random characters> %LocalAppData%\<random characters> %UserProfile%\Templates\<random characters>

View Associated ICE Cyber Crime Center Ransomware Registry Information

<p>Adds or Changes:</p> HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{28949824-6737-0594-0930-223283753445} HKEY_CLASSES_ROOT\CLSID\{28949824-6737-0594-0930-223283753445} HKEY_CURRENT_USER\Software\Microsoft\Command Processor "AutoRun" = "<malware path>\<random>.exe" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "<random>.exe" = "<malware path>\<random>.exe" HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "cmd.exe" HKEY_CLASSES_ROOT\CLSID\{28949824-6737-0594-0930-223283753445}\InProcServer32 "(Default)" = "<malware path>\<random>.dll" HKEY_CLASSES_ROOT\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03}\InProcServer32 "(Default)" = "<malware path>\<random>.dll" <p>Deletes:</p> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv <malware path>\<random>.exe" <malware path>\<random>.dll %AppData%\<random characters> %CommonAppData%\<random characters> %LocalAppData%\<random characters> %UserProfile%\Templates\<random characters>

This is a self-help guide. Use at your own risk. can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus,Trojan,Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.

search guides


Remember Me
Sign in anonymously