TONO virus is a ransomware program that claims to be a real Police / Politi department but in reality it is a bad program which steals your money. In most cases, user is completely unaware of being infected by TONO police scam till a scary warning sppears on the main screen which says “Datamaskinen din har blitt låst” meaning your computer has been locked due to violation of copyright laws. The tono virus says that it has been observing your IP address and finally it has found that your computer is used for illegal activities such as downloading pirated music, videos or softwares or even distributing/watching child porns therefor we have locked your computer. Then it goes you have to pay a fine of some (random) euro within 48 to 72 hours if you want to regain access to your PC. You,ll be instructed to buy PaySafeCard or Ukash credit to send the money as a penalty fee.
You are highly recommended to ignore Tono virus and Datamaskinen din har blitt låst computer lock scam. It is a fake software that should be uninstalled as soon as possible using a powerful malware removal software.
What are symptoms and possible risks of TONO computer lock scam:
Computer locked by TONO computer lock scam scam?
Need not to worry if your PC is infected. An efficient anti-malware program can fix your PC. If you want to remove it manually, please keep in your mind that manual removal is a complicated thing. Moreover this method dose not ensure 100% removal of malware. The best, easy and simple way to get rid of this virus is to install a proper anti-malware tool.
TONO computer lock scam Manual removal instruction:
Please make sure to create backup before getting started.
Stop malicious processes:
Open windows task manager, go to “Processes” tab and stop any TONO computer lock scam process which is running. It can be stopped by Right click on it and select “End process”.
Remove TONO computer lock scam corrupt registry settings:
Open Windows Registry editor by typing REGEDIT into RUN. Find and delete any keys and values related with this malware. (Please use the name of Malware to search for keys related to it)
Below is a list of possibly infected registry keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = 0
Delete TONO computer lock scam infected files & folders
Go to My Computer, search for malware files. Delete all the files and folders found. (Please use the name of Malware to search for keys related to it).
Possible locations:
%UserProfile%\
%UserProfile%\Application Data\
%UserProfile%\Start Menu\Programs\
TONO computer lock scam removal tools
To remove this virus Automatically, We suggest following softwares:
Malware Bytes Anti-Malwar
