CONTENT BLOCKED SOPA PIPA Virus

What is CONTENT BLOCKED SOPA PIPA?

The Content Blocked Sopa Pipa (Stop the pirates - International Police Association) message makes assertions that users have illegally downloaded MP3s, movie, and software files, and consequently, their computers are now locked (all files encrypted).

This message is a scam, a ransomware infection created by cyber criminals to infiltrate computers using 'exploit kits' and infected email messages. After successful infiltration, this malware encrypts files found on victims' computers (adding six digits to the prefix of each file) and writes a file called HOW TO DECRYPT FILES.txt in each folder containing the compromised files.

To decrypt the files, CONTENT BLOCKED SOPA PIPA ransomware demands payment of a 50 EURO ransom (or 10 Euros if paid in Bitcoins or Webmoney) using Ukash or PaysafeCard (electronic money systems that allows users to exchange their cash in return for a secure code to make payments online).

After successful payment, cyber criminals claim to provide a password to decrypt the files. Fortunately, security researcher, Nathan Scott, has developed a decryption tool able to decrypt the compromised files without paying the ransom. (Download this tool here).

Ransomware infections such as Content Blocked SOPA PIPA (including Alpha Crypt, CryptoWall, and CTB-Locker) present a strong case to maintain regular backups of your stored data.

Note that paying the ransom as demanded by this ransomware is equivalent to sending your money to cyber criminals - you will support their malicious business model and there is no guarantee that your files will ever be decrypted.

To avoid computer infection with ransomware infections such as this, express caution when opening email messages, since cyber criminals use various catchy titles to trick PC users into opening infected email attachments.

If your computer is affected by this ransomware, use the decrypt tool to regain control of your compromised files without paying the ransom. If this tool fails, another possible solution is to remove the ransomware virus and then restore your data from a backup.

Fake message presented by Content blocked Sopa Pipa ransomware:

International Police Association - IAC Stop the pirates International Administration Center Illegally downloaded material (MP3's, Movies or Software) has been located on your computer. By downloading, those were reproduced, thereby involving a criminal offense under Section 106 of Copyright Act. The downloading of copyrighted material via the internet or music sharing networks is illegal and is in accordance with Section 106 of the Copyright Act subject to a fine or imprisonment for a penalty of up to 3 years. Futhermore, possession of illegally downloaded material is punishable under Section 184 paragraph 3 of the Criminal Code and may also lead to the confiscation of the computer, with which the files were downloaded. Please note: This fine may only be paid within 5 days, if you let 5 days pass without payment, the possibility of unlocking your computer expires. In this case a criminal case against you will be initiated automatically. In cases if you reinstall Windows and have ceased looked window for entering password do not despair. After that how you pay the fine we will send you detailed instructions on unlocked files. How to unlock files: In accordance with the Law "On Control and Protection of Information" on 02/01/2014 You have to pay a fine of 50 euros. For the convenience of paying a fine offer to use a secure form of payment through vouchers Ukash / PaysafeCard. You need to buy vouchers in the amount of EUR 50, after fill in the appropriate fields, code vouchers, your id and your email (it will come a password to unlock), and click "OK". If you have several available vouchers less dignity simply enter them one by one. In the case of timely payment of the fine, we guarantee 100% recovery of your data. After are unlocked your files, in order to avoid re-lock you must for 3 days to remove on your computer all the pirated content. Email support: [email protected] Attention, if you pay Bitcoins or Webmoney, the fee is only $ 10!

After successfully encryption, Content Blocked SOPA PIPA ransomware displays a message demanding that the user follows certain instructions to regain control of their files:

Warning! You have a computer found pirated content! All your files are encrypted! To decrypt files you need hxxp://stp.lixter.com visit the site and follow the instructions posted on it. Your id 968254 You can enter a password 5 times. Above this limit, all files will be deleted! Independent attempts to decrypt the data can lead to their loss.

Screenshot of how to decrypt files.txt (containing victim's ID and Password):

This ransomware changes the victim’s desktop wallpaper (CONTENT Blocked by SOPA PIPA under authority granted by H.R. 3261 & S.968):

To decrypt the files compromised by this ransomware infection, use StopPirates_Decrypter - available to download here.

If this tool fails, follow the instructions provided below:

Content Blocked SOPA PIPA ransomware removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is Content Blocked SOPA PIPA?
• STEP 1. Content Blocked SOPA PIPA ransomware removal using safe mode with networking.
• STEP 2. Content Blocked SOPA PIPA ransomware removal using System Restore.

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Go to the Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced Startup options, in the opened "General PC Settings" window select Advanced Startup. Click on the "Restart now" button. Your computer will now restart into "Advanced Startup options menu".

Click on the "Troubleshoot" button, then click on "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into the Startup Settings screen. Press "5" to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Step 2

Login to the account infected with the Content Blocked SOPA PIPA. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

3. Next, type this line: rstrui.exe and press ENTER.

4. In the opened window, click "Next".

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the Content Blocked SOPA PIPA ransomware virus infiltrating your PC).

6. In the opened window, click "Yes".

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining Content Blocked SOPA PIPA files.

To restore individual files encrypted by this ransomware, try using the Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of Content Blocked SOPA PIPA are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click on it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by Content Blocked SOPA PIPA you can also try using a program called Shadow Explorer. More information about how to use this program is available here.

To protect your computer from file encrypting ransomware, use reputable antivirus and anti-spyware programs.

Other tools known to remove Content Blocked SOPA PIPA:

• Malwarebytes Anti-Malware

▼ Show Discussion