Skip to content
Monitor live humans, bots, and datacenters Botcrawl Edge Try Edge Free
Cybersecurity

How to remove Police Central e-crime Unit (Virus Removal)

By Sean Doyle 4 min read

As of June 2012 two separate variants of ransomware titled Police Central e-crime Unit ransomware 1. Win32/Weelsof and 2. Win32/Reveton have been infecting numerous computers disguised as police units such as the Specialist Crime Directorate or Metropolitan Police. The Police Central e-crime Unit ransomware locks computer systems, claims the operating system or internet browser is locked due to a violation of laws, which may include distributing and visiting illegal pornography, such as child pornography, and zoofila, among other false claims. The e-crime Unit virus then demands a fine of 100 Euro or $100 (or other) be paid by UKash, Paysafecard, or other currency services.

Police Central e-crime Unit ransomware symptoms

1. Win32/Weelsof

■ A fake alert from an online authority Metro Police  stating the infected computer has been violating the law which states “this computer was locked to stop your illegal activity.”

■ Fake violation claims include: Your IP address was used to visit websites containing pornography, child pornography, zoofila, and child abuse.

■ The infection claims “Your computer also contains video files with pornographic content, elements of violence, and child pornography. Spam-messages with terrorist motives were also sent from your computer.” (please be aware these are false claims)

■ A demand for a penalty fine is made by the infection in order for infected systems to become unlocked and accessible again. “To unlock the computer you must pay a fine of 100 E” by use of Ukash or Paysafecard services.

Metropolitan Police Police Central e-crime Unit Virus
The first variant belongs to the Win32/Weelsof malware family. Basically, it’s a Trojan that allows hackers to perform a number of actions on the infected computer. And they certain can launch such fake Police warnings as shown in the image below.

While Win32/Weelsof clearly targets the United Kingdom, the infection has spread to many other countries as well and is expected to progress, change, and adapt to other countries in the future.

2. Win32/Reveton

■ A fake alert from an online authority Specialist Crime Directorate stating the infected computer has been violating the law which states “Your computer is blocked due to at least one of the reasons specified below.”

■ You have been violating Copyright and Related Rights Law (Video, Music, Software) and illegally using or distributing copyrighted content, thus infringing Article 128 of the Criminal Code of Great Britain.

■ Article 128 of the Criminal Code provides for a fine of two to five hundred minimal wages or a deprivation of liberty for two to eight years.

■ You have been viewing or distributing prohibited Pornographic content (Child Porno/Zoofilia and etc). Thus violating article 202 of the Criminal Code of Great Britain.

■ Illegal access to computer data has been initiated from your PC, or you have been… (incomplete wording)

■ Article 208 of the Criminal Code provides for a fine up to E 100,000 and/or a deprivation of liberty for four to nine years.

■ Illegal access has been initiated from your PC without our knowledge or consent, your PC may be infected by malware, thus you are violating the law on Neglectful Use of Personal Computer. (No such law)

Specialist Crime Directorate Police Central e-crime Unit virus

The second variant of Police Central e-crime Unit (PCeU) ransomware belongs to the Win32/Reveton malware family. The fake waning is different than the Weelsof version and much more sophisticated, claiming to be from Specialist Crime Directorate rather than Metropolitan Police.

How to remove Police Central e-crime Unit (Removal Instructions)

1. We strongly recommend writing down the toll free number below in case you run into any issues or problems while following the instructions. Our techs will kindly assist you with any problems.

1-888-986-8411
if you need help give us a call

2. Download and install the free or full version of Malwarebytes Anti-Malware.

download buy now

3. Open Malwarebytes Anti-Malware.

malwarebytes

4. Click the large Scan Now button or visit the “Scan” tab to scan your computer for Police Central e-crime Unit malware and malicious files.

malwarebytes anti-malware

5. Once the scan is complete, click the Quarantine All button to remove the files and restart your computer.

If you are still having issues with malware it is recommended to download and install a second opinion scanner, such as HitmanPro by Surfright to eradicate existing malicious files.

User accounts

Ransomware usually infects 1 user account on Windows systems at a time. Here are some tips to remove ransomware by using different user accounts.

  1. Log into an account not affected by malware (with administrative rights) and perform a scan with reputable software to detect and remove malware.
  2. You can also delete the infected account.
  3. Other options include creating a new user account to remove malware if only 1 Window’s user account is present on the computer system.

Internet/network issues

Safe Mode With Networking can be used to access the Internet for updates, drivers, removal software, or other files if internet and network connectivity is compromised.

Tags: Malware
Sean Doyle

Sean is a tech author and security researcher with more than 20 years of experience in cybersecurity, privacy, malware analysis, analytics, and online marketing. He focuses on clear reporting, deep technical investigation, and practical guidance that helps readers stay safe in a fast-moving digital landscape. His work continues to appear in respected publications, including articles written for Private Internet Access. Through Botcrawl and his ongoing cybersecurity coverage, Sean provides trusted insights on data breaches, malware threats, and online safety for individuals and businesses worldwide.

Related Posts

162 Comments

  1. thanks a lot, u just saved my £100, i almost paid! i actually just used the “safe mode” and after running the scan, evrythng was cleaned. cheers!!!! continue the good work!

  11. Hi,
    I was unfortunate to get this virus and had my system blocked.
    I tried to get to the Task manager but could’t do it so I tried to swich the user and logged on to my guest’s account.
    From there it was easy to start Norton Security which found and cleaned 46 threats then I restored the computer settings to a previous date using the system restore.

  19. […] what I find on google. Check this out, looks like a good thorough guide / read about the virus. How To Remove The Police Central e-crime Unit Ransomware Virus (Metropolitan Police, Crime Directora… __________________ I'm part of *The Project* 😉 Dont Eat Animals, Its Not Good For Them And […]

  24. Horrible experience but with iPad on the side giving me your instructions got through it. Cannot thank you enough. These virus guys should be dealt with.

  32. Thanks Sean, I was unable to access windows except using the command prompt technique. I was unable to restore my computer though as apparently system protection was not turned on?? I did manage to download malware bytes on a different computer and managed to install and run it through the safe mode cmd promt screen. This picked them up and cleared the problem. Many thanks!

  33. That was great. but I had this virus last night (30/01/2013) on my wife’s laptop and neither avast (free version) nor superantispyware professional version could detect the virus! probably its a new version. but the good thing is that restoring the system is still resolve the problem.

  34. Thank you mate, your a legend. Unfortunately I was so scared that I bought a UKASH voucher for £100 and entered it as said on the screen but still could not acess the computer. So I lost £100 but than I managed to get online using the different user account on the same computer and restored it to previous date and it is working fine. Hope there will be no more problems. once again thank you mate and keep up the good work.

  42. Thank you for your help. Was really scared when first saw it appear – then guessed it was a horrible virus so googled it and found this. Thanks a bunch man. I did a system restore and all seems ok now.

  46. Thanks very much for the help. It can be quite panicking when you’re told you’ve committed a crime, especially when you know you didn’t do so, so it’s great to know there are sites like this to help clear it up. Keep up the great work.

  47. God bless Sean Doyle . Beautiful. Followed instructions and got rid of the virus in less than 5 minutes. Thanks Sean for sharing your knowledge and expertise.

  49. Thank you. I have been able to get my system back after using the safe mode with command prompt. The virus had blocked anything else.
    I have windows 7 and didn’t get the rstrui.exe window but a help menu from where I could access the restore to an anterior date.
    Again thank you very much

  50. Great help. Thank you. I have Vista Ultimate and virus was removed. I run (as per your instructions) C:\windows\system32\rstrui.exe and press Enter and then followed all steps to restore my computer system to an earlier time and date, before infection. Spiros from Athens Greece.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.