Votre ordinateur a été bloqué pour violation de la loi Belgique ransomware unlocker

This is another ransomware program that strikes so many computers in the world today, primarily in Belgium, France and some other French-speaking countries. It completely locks the PC and does not let user do anything with it. The attempt to reboot the PC turns out to be unsuccessful. The virus asks for the ransom to be paid in the amount of 200 Euros. In fact, the virus accuses users of doing many bad things on their computer, for example:

• Watching illegal materials over the Internet
• Spreading and promoting SPAM
• Using non-licensed software, thus violating copyrights.
• Watching and listening to multimedia files in violation viwh copyrights.

Here is the quotation from what the ransomware scares users with:

ATTENTION! Votre ordinateur a été bloqué pour violation de la loi Belgique
Les infractions suivantes ont été détectées:

• Le fait, en vue de sa diffiision, de fixer, d'enregistrer ou de transmettre des matériels pornographique impliquant des mineurs
• SPAM
• Utilisation des logiciels en infraction avec les droits d'auteur
• Partager des fichiers multimédia en infraction avec les droits d'auteur

Pour débloquer votre ordinateur, vous devez payer 200 € dans les 3 jours prochaines. Si vous ne payez pas dans dans le délai précisé, votre ordinateur sera confisqués et votre cas sera soumis au tribunal.
Vous pouvez payer l'amende avec l'aide des vouchers Ukash ou Paysafecard. Acheter les vouchers par Ukash ou Paysafecard de 200 €. Ensuite, ouvrez le tab «Payer amende», remplir le forme avec les codes et vahiers des vouchers, et clique sur le bouton «Payer amende». Votre ordinateur sera débloqué dans les 24 heures suivantes.
Après le débloquage, nous suggérons que vous:

• Supprime toutes les fichiers multimédia en infraction avec les droits d'auteur.
• Supprime des logiciels en infraction avec les droits d'auteur.
• Installer un logiciel anti-virus, si vous n'en avez pas encore.
• Faire un scan anti-virus.

Votre SE: Windows XP
Votre adresse IP: [removed]

The ransomware instructs users to effect the sum of 200 Euros by means of Ukash of Paysafecard payment systems through indicating the special PIN code of respective voucher. Still, there is no guarantee that the problem will be solved after doing as instructed by the program. Making such payments in favor of fraudsters is a terrible mistake on user’s part. In order to unlock your computer more radical and professional methods are required. This is why we recommend you to consider this similar malware removal guide that can be found here.

Automatic removal solution (recommended):

1. Go to your friend, relative or anybody else who has computer with Internet connection.
2. Take your USB flash drive / Memory Stick with you.
3. Download GridinSoft Trojan Killer installation file from this site http://trojan-killer.net/download.php and save it to your USB flash drive / Memory Stick.



4. Get back to your infected PC and insert the USB Drive / Memory Stick into the respective USB slot.
5. Perform hard reset (press reset button on your computer) if your infected PC has been on with Activité illicite demelee virus background. If not, then simply turn your PC on.
6. Before the very boot process begins keep repeatedly hitting “F8” button on your keyboard.
7. In the window that appeared select “Safe mode with command prompt” option and press Enter.
8. Choose your operating system and user account which was infected with Activité illicite demelee virus.
9. In the cmd.exe window type “explorer” and press “Enter” button on your keyboard.
10. Select “My Computer” and choose your USB flash drive / Memory Stick.
11. Run the installation file of GridinSoft Trojan Killer. Install the program and run scan with it. (update of the program will not work for “Safe mode with command prompt” option)
12. When the hijackers are successfully disabled (fixed) by GridinSoft Trojan Killer you may close GridinSoft Trojan Killer application.
13. In the cmd.exe window type “shutdown /r /t 0” and press “Enter” button on your keyboard.
14. Upon system reboot your PC will be unlocked and you will be able to use it just as before the infection took pace.
15. However, it is recommended that you now update GridinSoft Trojan Killer and run the scan with it again to remove the source of the infections causing Activité illicite demelee virus to infect your PC.

Automatic removal video:

Activité illicite demelee manual removal milestones (optional and might not be effective):

1. Restart your system into "Safe Mode with Command Prompt". While the PC is booting press the "F8 key" continuously, which should present the "Windows Advanced Options Menu" as presented in the image below. Apply the arrow keys in order to move to "Safe Mode with Command Prompt" and hit Enter key of your keyboard. Login as the same user you were previously logged in under the normal Windows mode.

2. Once Windows boots successfully, the Windows command prompt would appear as described at the screenshot below. At the command prompt, type-in the word "explorer", and press Enter. Windows Explorer should open. Please do not yet close it. You can minimize it for a while.

3. Afterwards open the Registry editor by applying the same Windows command prompt. Type-in the word "regedit" and hit Enter button of your keyboard. The Registry Editor should open.


You know how it normally looks like, don't you? Well, here is the screenshot of it:


4. Find the following registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ In the right-side panel select the registry entry named Shell. Right click on this registry key and select "Modify" option. Its default value should be "Explorer.exe". However, Activité illicite demelee virus did its job, and so after you click "Modify" you would see totally different value of this registry entry.

5. Copy the location of the modified value of the above-mentioned registry entry to the piece of paper or memorize its location. It shows where exactly the main executable of Activité illicite demeleevirus is located.
6. Modify the value of the registry entry back to "explorer.exe" and save the settings of the Registry Editor.
7. Go to the location indicated in the value of modified registry entry. Remove the malicous file. Use the file location you copied into the piece of paper or otherwise noted in step in previous step. In our case, Activité illicite demelee virus file was located and running from the Desktop. There was a file called "contacts.exe", but it may have different (random) name.
8. Get back to "Normal Mode". In order to reboot your PC, when at the command prompt, type-in the following phrase "shutdown /r /t 0" (without the quotation marks) and hit Enter button.
9. The virus should be gone. However, in order to clean your PC from other possible virus threats and malware remnants, make sure to download and run GridinSoft Trojan Killer downloadable through the button below.

Manual removal video:

Associated virus files to be removed:

[random].exe

Associated virus registry entries to be removed:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "[random].exe"