print version

ICPP-Online

For Information and Removal of ICPP-Online

ICPP-Online

In the days of audio cassettes and compact discs, piracy existed as bootleggers made illegal copies for distribution. Today, as we shift to digital music, it is much easier to download music and videos without proper authorization.  It has seemed like a victimless crime for years, but the economic impact to the music industry is severe.  It is a heated issue and one that is cropping up more and more in the news.  And maybe on your computer as well.  A new extortion Trojan, known as ICPP-Online, is seeking to capitalize on the intense interest and confusion surrounding digital piracy and persuade computer owners they have broken the law.

What is ICPP-Online?

Because it is very easy to inadvertently download an image, video, or song without proper authorization, many people are not even aware they have infringed on a copyright.  ICPP-Online is counting on this: the fictitious organization issues warnings to computer users, telling them that illegal torrents, or files, have been found in their systems.  To avoid paying a large fine and facing possible jail time, users are urged to accept a "pre-trial settlement."  By simply paying ICPP $400 in fees, you avoid severe penalties.

There are two important things to remember about ICPP-Online: 

• ICPP-Online does not, and in fact, cannot, scan your computer for illegal files.  The absence or presence of copyright-infringed material is completely irrelevant because this is a false scan and a false warning.
• It is an extortion Trojan, which means that its sole goal is to persuade you to pay the nonexistent ICPP and provide your credit card numbers.

ICPP-Online is also known as the ICPP-Online.com, Antipiracy Foundation Scanner, I-Q Manager, and Trojan.Fakecopyright.  It purports to be associated with the MPAA (Motion Picture Association of America) and the RIAA (Recording Industry Association of America) but is not affiliated with these legitimate organizations.

Recognizing ICPP-Online

Unlike many other Trojans, ICPP-Online is very clear in its purpose, and it is very easy to recognize from its pop-up messages.  As you browse online, may receive a message like the following:

Windows has detected that you are using content that has been downloaded violating copyright of its respective owners.  Please read the following bulletin and try to solve the problem in one of the recommended ways.

The options given are "Pass case to court" and "Settle case in pre-trial order."  The pop-up is very detailed and will tell you what has happened and why they are issuing this warning to you.  The message goes on to tell you:

Probably you've been using file-sharing clients, torrents, or downloaded the content straight from the website. In any of those cases, you have violated the copyright of the respective owners. In most countries, this type of activity is prosecuted and serious penalties are imposed.  Maximum penalties could be five years in prison and up to $250,000 in fines.

Another message you may see:

Warning!

This computer is being used for illegal activity associated with copyright violation.  Records about this computer's owner are about to be sent to court. If you saw this message by accident, please report any information about a possible owner of this comp.

If you click on any portion of these ads, you will be directed to an ICPP rogue website, on which ICPP claims to be a law firm "which specialises in assisting copyright holders exploit and enforce their rights globally."  ICPP claims to have developed "effective and unique methods for organisations to enforce their intellectual rights. By working effectively with forensic IT experts, law firms, and antipiracy organisations, we seek to eliminate the illegal distribution of copyrighted material through our revolutionary business model."  It is worth reiterating that this is not a law firm, nor can ICPP scan your computer.

How is ICPP-Online Distributed?

The ICPP-Online Trojan is distributed through "scareware" sites, or those that advertise and promote rogue antivirus programs.  Affected sites (which typically include adult, warez, gaming, freeware, peer-to-peer, and social networking sites) harbor Trojans, which can enter your system when you click on an ad, banner, image, or video. Even visiting such a site may be enough to allow a Trojan like ICPP-Online into your system.

Removing ICPP-Online

If you see notices like the above popping up on your computer, it is important to take immediate steps to remove ICPP-Online from your systems.  If left unchecked, you could experience slow performance, redirects to ICPP websites, changed browser settings, and more copyright violation alerts.  By changing your security settings, ICPP-Online can create vulnerabilities that allow other forms of malware in.  Routine security scans will likely miss ICPP-Online because it is not classified as a virus.

Automatic removal is the recommended course of action: a program like Malwarebytes Anti-Malware (Malwarebytes has free malware removal) can quickly, easily, and effectively detect and remove this Trojan without risk to your legitimate files and programs.  Manual removal is more difficult because there is the risk that you could inadvertently delete a necessary file or fail to remove ICPP-Online in its entirety.  If you have technical expertise, as well as a great deal of patience, the following instructions will help you remove ICPP-Online from your system:

Remove Files and Folders:

%UserProfile%\Application Data\IQManager
%UserProfile%\Application Data\IQManager\iqmanager.exe
%UserProfile%\Application Data\IQManager\settings.ini
%UserProfile%\Application Data\IQManager\torrents
%UserProfile%\Application Data\IQManager\uninstall.exe
%UserProfile%\Application Data\IQManager\wallpaper.jpg
%UserProfile%\Application Data\IQManager\languages
%UserProfile%\Application Data\IQManager\languages\Czech.lng
%UserProfile%\Application Data\IQManager\languages\Danish.lng
%UserProfile%\Application Data\IQManager\languages\Dutch.lng
%UserProfile%\Application Data\IQManager\languages\English.lng
%UserProfile%\Application Data\IQManager\languages\French.lng
%UserProfile%\Application Data\IQManager\languages\German.lng
%UserProfile%\Application Data\IQManager\languages\Italian.lng
%UserProfile%\Application Data\IQManager\languages\Portuguese.lng
%UserProfile%\Application Data\IQManager\languages\Slovak.lng
%UserProfile%\Application Data\IQManager\languages\Spanish.lng
%UserProfile%\Application Data\IQManager\languages\template.lng
%UserProfile%\Desktop\I-Q Manager.lnk

Remove Registries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IQManager
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "iqmanager.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%UserProfile%\Application Data\IQManager\iqmanager.exe

Removing ICPP-Online Automatically/Safely

For free automatic removal we recommend using Malwarebytes Anti-Malware. This program is widely recommended by reputable third-party sites, so you can be reasonably confident of its ability to safely get rid of ICPP-Online and any hidden Trojans. As a precaution we recommend double checking your system with Spyware Doctor. This program requires paid registration to enable deletions, however it has a money back guaranteed and is the top of the line in malware removal. It should catch malware that evades Malwarebytes and block anything that tries to reinstal itself.

Remove ICPP-Online Now:

1. Download and install Malwarebytes Anti-Malware and Spyware Doctor  
2. Run Reimage PC Repair Online to check for malware damage and repair if required.
3. Run a scan with Malwarebytes Anti-Malware.
4. Remove all the detected infections (free).
5. Run a scan with Spyware Doctor
6. Remove any remaining infections
7. Reboot and rescan with Spyware Doctor. Your computer should now be clean.

Important note: If Malwarebytes is blocked by malware then run Chameleon (Start Menu → All Programs → MalwareBytes' Anti-Malware → Tools → Malwarebytes' Anti-Malware Chameleon). If you need further help removing ICPP-Online please email us at info@removeadware.com.au or call for personal assistance on toll-free number 888-655-3453, within the USA and Canada.

 to top