The SOPA virus (SOPA Moneypak) is very dangerous malware categorized as ransomware that shows a fake alert message disguised as the S.O.P.A. Organization claiming the computer system has copyright material on the system and/or pornography  and other illegal material. The fake SOPA virus screen states that the S.O.P.A Organization is going to delete/erase the computer’s data unless a fine is payed within the allotted time of 72 hours by use of Green Dot Moneypak cards (see FBI virus). When the SOPA virus “holds a system hostage” during an infection the computer user is informed that the computer and/or IP address (Internet Protocol) is now on a Black List of SOPA’s and/or other’s Anti-Piracy organization’s database and will stay there unless the fine of 200 USD  or euros is through using Moneypak.

A version (variant) of the SOPA ransomware virus is pictured below. Your screen may appear similar, though often these screens change.

[Warning_Box]Please be aware, this is infection has nothing to do with SOPA. You are not in legal trouble. Still, this virus is very dangerous and if not removed you may lose your system files and complete computer functionality. With backdoor infections you are also vulnerable to multiple accounts of cyber crime including identity theft. Similar Ransomware such as the FBI virus use these tactics in order to scare the victim into paying a fine, but even if the fine is paid you are still infected with a virus. Removing the SOPA virus immediately using the instructions provided in this article is strongly urged.[/Warning_Box]

SOPA virus details and symptoms

• SOPA virus can easily get inside the system through its backdoors using malicious email attachments, freeware and/or shareware for its undetected infiltration.
• During a SOPA virus the computer system becomes locked. Victims have suggested that most of the time their systems have locked once rebooting the system.
• The SOPA virus then displays a fake ATTENTION message stating:

Stop Online Piracy Automatic Protection System
Your computer is locked!

If you see a warning.txt or warning screen, it means your IP address was included in S.O.P.A. Black List.
One or more of the following items were made from your PC:

1. Downloading or distributing audio or video files protected by Copyright Law.
2. Downloading or distributing illegal content (child porn, phishing software, etc.)
3. Downloading or distributing Software protected by Copyright Law.
As a result of these infringements based on Stop Online Piracy Act (H.R. 3261) your PC and files are now blocked.You can remove your IP from black list and unlock PC and files by paying a fine of 200 (USA and Canada)/200 EUR (via Western Union to other Countries)
(…)
WARNING!!!: If you don’t pay the fine within 72 HOURS at the amount of 200 USD, all your computer data will be erased

How to remove the SOPA virus

Victims of the SOPA virus will require different steps and need to use different options in order to successfully remove the virus. Some victims can access the internet while others can not.

1. System Restore

Restore your computer to a date and time before infection using an automatic restore point created by your operating system. Your files will not be deleted performing a system restore. Installations of software and OS updates after the chosen restore date may be removed.

Click here for complete System Restore instructions and options

2. Antivirus / Anti-Malware Software

Use suggested free or paid versions of Antivirus/Anti-Malware software.

5/5	5/5	4/5	3/5
Purchase Now	Purchase Now	Purchase Now	Purchase Now
Free Download	Free Download	Free Download	Free Download

Other: Microsoft Defender (free), Microsoft Security Essentials (free)

3. Safe Mode With Networking

Safe mode with networking is often suggested by Microsoft for users needing access to the Internet or the network they’re connected to. This mode is helpful for when you need to be in Safe Mode to troubleshoot but also need access to the Internet for updates, drivers, removal software, or other files to help troubleshoot your issue.

• This mode will also bypass any issues where Antivirus or Anti Malare applications have been affected by the ransomware.

The plan with this option is to enter your computer in “safe mode with network” and install anti-malware software. Proceed to scan, and remove  malicious files.

1. Reboot your computer in “Safe Mode with Networking”. As the computer is booting (when it reaches the manufacture’s logo) tap and hold the “F8 key” continuously to reach the correct menu. On the Advanced Boot Options screen, use your keyboard to navigate to “Safe Mode with Networking” and press Enter. Shown below.

• Make sure to log into an account with administrator rights.

The screen may appear black with the words “safe mode” in all four corners. Click your mouse where windows start menu is to bring up necessary browsing.

2. There are a few different things you can do…

• Pull-up the Start menu, enter All Programs and access the StartUp folder.
• Remove “ctfmon” link (or similar).

This seems to be an easy step in removing similar ransomware. If you are interested in learning about ctfmon.exe please click here.

You may or may not be able to find the ctfmon file. Move onto the next steps (which is not a necessity if you removed the file above but provides separate options for troubleshooting).

3. If you still can’t access the Internet after restarting in safe mode, try resetting your Internet Explorer proxy settings. These 2 separate options and following steps will reset the proxy settings in the Windows‌ registry so that you can access the Internet again.

How To Reset Internet Explorer Proxy Settings

Option 1
In Windows 7, click the Start button . In the search box, type run, and then, in the list of results, click Run.
-or-
In Windows Vista, click the Start button , and then click Run.
-or-
In Windows XP, click Start, and then click Run.

Copy and paste or type the following text in the Open box in the Run dialog box and click OK:
[Normal_Box]reg add “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /v ProxyEnable /t REG_DWORD /d 0 /f[/Normal_Box]

In Windows 7, click the Start button . In the search box, type run, and then, in the list of results, click Run.
-or-
In Windows Vista, click the Start button , and then click Run.
-or-
In Windows XP, click Start, and then click Run.

Copy and paste or type the following text in the Open box in the Run dialog box and click OK:
[Normal_Box]reg delete “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /v ProxyServer /f[/Normal_Box]
Restart Internet Explorer and then follow the steps listed previously to run the scanner

Option 2
Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab.
Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

4. It is now recommended to download Malwarebytes (free or paid version) and run a full system scan to remove the SOPA virus from your computer.
[Info_Box]

SOPA virus removal TIPS:

If you are having issues removing the SOPA virus try one of the options below.[/Info_Box]

*Logging In As A Different User Is Allowed

In most cases if there are multiple accounts on your Window’s system you will be able to access the other accounts which were not infected without conflict from the virus.
If a second account has administrator rights, in some cases you will be able to remove the fake SOPA infection using this user.

Deny Flash Option

The SOPA virus uses flash and in some cases disabling (denying) flash can “freeze” the ransomware in order to use software to remove the infection.
1. To disable (deny) flash visit:http://www.macromedia.com/support/documentation/en/flashplayer/help/help09.html
2. Select the “Deny” radio option
3. Proceed to a removal option (detailed below): Anti malware software scan and removal or system restore.

Flash Drive Option

1. Turn off your computer system and Unplug your internet connection
2. Turn the machine back on (In some cases the virus can only open if your machine is plugged into the internet)
3. On another (clean) computer, download Malwarebytes and load the Mbam-Setup.exe (or similar) file onto the flash drive
4. Remove the flash drive from the clean computer and insert it into the affected machine, proceed to install Malwarebytes using the setup file located on the flash drive.
5. Run a full system scan, Malwarebytes will find and eradicate malicious files
6. Restart your machine