Remove MoneyPak and Paysafecard Ransomware Trojan

Photo of author

Written by: Stelian Pilici

Published on:

If your computer has been locked and you are seeing a notification from the police, asking you to pay a fine via Ukash, MoneyPak or PaySafeCard, then you are reading this article to understand if it’s real and how to get rid of it.
The newest form of attack used by cyber criminals, is a piece of malware called Trojan Reveton, which will display a bogus notification that pretends to be from your local police department, and states that your computer has been blocked due to it being involved with the distribution of pornographic material, SPAM and copyrighted content.
This new form of malware will lock you out of your computer and applications, so whenever you’ll try to log on into your Windows operating system or Safe Mode with Networking, it will display instead a lock screen asking you to pay a non-existing fine in the form of a Ukash or PaySafeCard code.
Furthermore, to make its alert seem more authentic, this virus also has the ability to access your installed webcam so that the bogus Ukash notification shows what is happening in the room.

If your computer is infected with Ukash virus,then you’ll see a notification from your local police department, below you can see just a few examples on how this alerts might look:

The Ukash Ransom is a scam and you should ignore any alert that this malicious software might generate and remove this trojan ransomware from your computer.
Under no circumstance should you send any money to this cyber criminals,as this could lead to identity theft,and if you have, you should request a refund from Ukash stating that you are the victim of a scam and computer virus.

Ukash Police Ransom – Virus Removal Guide

This page is a comprehensive guide, which will remove the Ukash infection from your your computer. Please perform all the steps in the correct order. If you have any questions or doubt at any point STOP and ask for our assistance.
The Ukash will start automatically when you login to your computer and display its screenlocker so that you are unable to access your computer, therefore we will need to remove this infection by using any of the below methods:
OPTION 1: Remove Ukash lock screen virus with System Restore
OPTION 2: Remove Ukash virus with with HitmanPro Kickstart
OPTION 3: Remove Ukash virus with Kaspersky Rescue Disk

OPTION 1: Remove Ukash lock screen virus with System Restore

System Restore helps you restore your computer’s system files to an earlier point in time. It’s a way to undo system changes to your computer without affecting your personal files, such as e‑mail, documents, or photos.
Because the Ukash virus will not allow you to start the computer in Windows regular mode, we will need to start System Restore from the Safe Mode with Command Prompt mode.

STEP 1: Restore Windows to a previous state using System Restore

  1. Reboot your computer into Safe Mode with Command Prompt. To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard.
    [Image: F8 key]
    If you are using Windows 8, the trick is to hold the Shift button and gently tap the F8 key repeatedly, this will sometimes boot you into the new advanced “recovery mode”, where you can choose to see advanced repair options. On the next screen, you will need to click on the Troubleshoot option, then select Advanced Options and select Windows Startup Settings. Click on the Restart button, and you should now be able to see the Advanced Boot Options screen.
  2. Using the arrow keys on your keyboard, select Safe Mode with Command Prompt and press Enter on your keyboard.
    [Image: Starting computer in Safe Mode with Command Prompt]
  3. At the command prompt, type rstrui.exe, and then press ENTER.
    [Image: Start System Restore to remove lock screen virus]
    Alternatively, if you are using Windows Vista, 7 and 8, you can type: C:\windows\system32\rstrui.exe , and press Enter. And if you are a Windows XP user, type C:\windows\system32\restore\rstrui.exe, then press Enter.
  4. System Restore should start, and you will display also a list of restore points. Try using a restore point created just before the date and time the Ukash lock screen virus has infected your computer.
    [Image: Restore settings to remove ransomware]
  5. When System Restore has completed its task, start your computer in Windows regular mode, and perform a scan with Malwarebytes Anti-Malware and HitmanPro, as seen in the next step.

STEP 2: Remove Ukash malicious files with Malwarebytes Anti-Malware Free

Even after using System Restore,

  1. You can download Malwarebytes Anti-Malware Free from the below link, then double-click on the icon named mbam-setup.exe to install this program.
    MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK(This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
  2. When the installation begins, keep following the prompts in order to continue with the setup process, then at the last screen click on the Finish button.
    [Image: Malwarebytes Anti-Malware final installation screen]
  3. On the Scanner tab, select Perform quick scan, and then click on the Scan button to start searching for the Ukash malicious files.
    [Image: Malwarebytes Anti-Malware Quick Scan]
  4. Malwarebytes’ Anti-Malware will now start scanning your computer for Ukash virus as shown below.
    [Image: Malwarebytes Anti-Malware scanning for Ukash
  5. When the Malwarebytes Anti-Malware scan has finished, click on the Show Results button.
    [Image: Malwarebytes Anti-Malware scan results]
  6. You will now be presented with a screen showing you the computer infections that Malwarebytes Anti-Malware has detected. Make sure that everything is Checked (ticked), then click on the Remove Selected button.
    [Image: Malwarebytes Anti-Malwar removing Ukash virus]

STEP 3: Double-check for the Ukash virus with HitmanPro

  1. You can download HitmanPro from the below link:
    HITMANPRO DOWNLOAD LINK (This link will open a web page from where you can download HitmanPro)
  2. Double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows). When the program starts you will be presented with the start screen as shown below.
    HitmanPro scanner
    Click on the Next button, to install HitmanPro on your computer.
    HitmanPro installation
  3. HitmanPro will now begin to scan your computer for Ukash malicious files.
    HitmanPro detecting for Ukash virus
  4. When it has finished it will display a list of all the malware that the program found as shown in the image below. Click on the Next button, to remove Ukash virus.
    HitmanPro scan results
  5. Click on the Activate free license button to begin the free 30 days trial, and remove all the malicious files from your computer.
    [Image: HitmanPro 30 days activation button]

OPTION 2: Remove Ukash virus with with HitmanPro Kickstart

If you cannot start your computer into Safe Mode with Command Prompt mode, we can use the HitmanPro Kickstart program to bypass Ukash lock screen.
As the Ukash ransomware infection locks you out of your computer, you will need to create a bootable USB drive that contains the HitmanPro Kickstart program.
We will then boot your computer using this bootable USB drive and use it to clean the infection so that you are able to access Windows normally again.
You will also need a USB drive, which will have all of its data erased and will then be formatted. Therefore, only use a USB drive that does not contain any important data.

  1. Using a “clean” (non-infected) computer, please download HitmanPro Kickstart from the below link.
    HITMANPRO DOWNLOAD LINK (This link will open a download page in a new web page from where you can download HitmanPro Kickstart)
  2. Once HitmanPro has been downloaded, please insert the USB flash drive that you would like to erase and use for the installation of HitmanPro Kickstart. Then double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows).
    To create a bootable HitmanPro USB drive, please follow the instructions from this video:
  3. Now, remove the HitmanPro Kickstart USB drive and insert it into the Ukash infected computer.
  4. Once you have inserted the HitmanPro Kickstart USB drive, turn off the infected computer and then turn it on. As soon as you power it on, look for text on the screen that tells you how to access the boot menu.
    [Image: Windows Boot Menu screens]
    The keys that are commonly associated with enabling the boot menu are F10, F11 or F12.
  5. Once you determine the proper key (usually the F11 key) that you need to press to access the Boot Menu, restart your computer again and start immediately tapping that key. Next, please perform a scan with HitmanPro Kickstart as shown in the video below.
  6. HitmanPro will now reboot your computer and Windows should start normally. Then please Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

OPTION 3: Remove Ukash virus with Kaspersky Rescue Disk

If any of the above methods did not clean your infected computer, we can use a Kaspersky Rescue Disk Bootable to clean the Windows registry and to perform a system scan to remove the Ukash virus.
To create a bootable Kaspersky Rescue Disk, we will need the following items:

  • A clean (non-infected) computer with Internet access
  • A blank DVD or CD
  • A computer with a DVD or CD burner

STEP 1: Download and create a bootable Kaspersky Rescue Disk CD

  1. You can download Kaspersky Rescue Disk utility from link below:
    KASPERSKY RESCUE DISK DOWNLOAD LINK (This link will automatically download Kaspersky Rescue Disk (kav_rescue_10.iso) on your computer.)
  2. To create the bootable rescue disk, we will need to use the ImgBurn program. You can download ImgBurn from the below link, then install this program.
    IMGBURN DOWNLOAD LINK (This link will open a new page from where you can download the ImgBurn program)
  3. Insert your blank DVD or CD in your burner, then start ImgBurn and click on the Write image file to disc button.
  4. Under Source click on the Browse for file button, then navigate to the location where you previously saved the Kaspersky Rescue Disk utility (kav_rescue_10.iso), then click on the Write button.
    [Image: Bootable Kaspersky Rescue CD]
    That’s it, ImgBurn will now begin writing your bootable Kaspersky Rescue Disk.

STEP 2: Start your computer using the Kaspersky Rescue Disk

  1. Once you’ve got the Kasperky Rescue Disk in hand, insert it into the infected computer, and turn off and then turn it on again.
  2. As soon as you power it on, you will see a screen that tells you to press any key to enter the menu, so please tap any key to boot your machine from the Kaspersky Rescue Disk.
    [Image: Starting infected computer from Kaspersky Rescue Disk]
  3. In the next screen, you will need to chose a language, then you click on Kaspersky Rescue Disk. Graphic Mode and press ENTER, to start the Kaspersky Rescue Disk.[Image: Kaspersky Rescue Disk Graphic Mode screen]

STEP 3: Scan your system with Kaspersky Rescue Disk

  1. Within a few short seconds you should see the full working environment, with the Kaspersky Rescue Disk screen front and center as shown below.
    [Image: Kaspersky Rescue Disk scanner]
  2. Switch tabs over to the My Update Center, and then click the Start update button to load the latest anti-virus definitions. Please be patience while this process its completed.
    [Image: Updating Kaspersky Rescue Disk antivirus definitions]
  3. Switch back over to the Objects Scan tab, select the drives you want to scan, and then click the Start Objects Scan button.
    [Image: Kaspersky Rescue Disk scan]
  4. When Kaspersky Antivirus will detect the Ukash virus, you’ll be prompted to select an action. When this happens, please select Quarantine or Delete to remove this infection from your computer.
    [Image: Kaspersky Rescue Disk prompt]
  5. When the antivirus scan has completed, you can restart back into Windows regular mode, by clicking on the Kaspersky Start button [Image: Kaspersky Rescue Disk Restart button] (lower left corner), and selecting Restart.
    Once your computer will start in Windows regular more, download Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

Your computer should now be free of the Ukash infection. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.
If you are still experiencing problems while trying to remove Ukash virus from your machine, please start a new thread in our Malware Removal Assistance forum.

How to Stay Safe Online

Here are 10 basic security tips to help you avoid malware and protect your device:

  1. Use a good antivirus and keep it up-to-date.

    Shield Guide

    It's essential to use a good quality antivirus and keep it up-to-date to stay ahead of the latest cyber threats. We are huge fans of Malwarebytes Premium and use it on all of our devices, including Windows and Mac computers as well as our mobile devices. Malwarebytes sits beside your traditional antivirus, filling in any gaps in its defenses, and providing extra protection against sneakier security threats.

  2. Keep software and operating systems up-to-date.

    updates-guide

    Keep your operating system and apps up to date. Whenever an update is released for your device, download and install it right away. These updates often include security fixes, vulnerability patches, and other necessary maintenance.

  3. Be careful when installing programs and apps.

    install guide

    Pay close attention to installation screens and license agreements when installing software. Custom or advanced installation options will often disclose any third-party software that is also being installed. Take great care in every stage of the process and make sure you know what it is you're agreeing to before you click "Next."

  4. Install an ad blocker.

    Ad Blocker

    Use a browser-based content blocker, like AdGuard. Content blockers help stop malicious ads, Trojans, phishing, and other undesirable content that an antivirus product alone may not stop.

  5. Be careful what you download.

    Trojan Horse

    A top goal of cybercriminals is to trick you into downloading malware—programs or apps that carry malware or try to steal information. This malware can be disguised as an app: anything from a popular game to something that checks traffic or the weather.

  6. Be alert for people trying to trick you.

    warning sign

    Whether it's your email, phone, messenger, or other applications, always be alert and on guard for someone trying to trick you into clicking on links or replying to messages. Remember that it's easy to spoof phone numbers, so a familiar name or number doesn't make messages more trustworthy.

  7. Back up your data.

    backup sign

    Back up your data frequently and check that your backup data can be restored. You can do this manually on an external HDD/USB stick, or automatically using backup software. This is also the best way to counter ransomware. Never connect the backup drive to a computer if you suspect that the computer is infected with malware.

  8. Choose strong passwords.

    lock sign

    Use strong and unique passwords for each of your accounts. Avoid using personal information or easily guessable words in your passwords. Enable two-factor authentication (2FA) on your accounts whenever possible.

  9. Be careful where you click.

    cursor sign

    Be cautious when clicking on links or downloading attachments from unknown sources. These could potentially contain malware or phishing scams.

  10. Don't use pirated software.

    Shady Guide

    Avoid using Peer-to-Peer (P2P) file-sharing programs, keygens, cracks, and other pirated software that can often compromise your data, privacy, or both.

To avoid potential dangers on the internet, it's important to follow these 10 basic safety rules. By doing so, you can protect yourself from many of the unpleasant surprises that can arise when using the web.

140 thoughts on “Remove MoneyPak and Paysafecard Ransomware Trojan”

  1. THANK YOU, THANK YOU, THANK YOU!! Your help was clear, precise and so helpful! I’m not very computer savvy, but your instruction’s get me straightened out when I thought things were pretty scary.

  5. Stelian. You are a lifesaver.
    I managed to remove the virus using System Restore on a compaq presario running XP sp3. To get to safe mode, I had to hit F8 almost as soon as I switched the computer on. I was then given the option of logging on as Administrator (which doesn’t usually appear) – and I did and followed your instructions for restoring the system and removing the virus. Phew!
    Very relieved and very very grateful. Many thanks

  6. Hey, This virus hit me on my work laptop and in my line of work, the things that were on there were so horrible that I was packing death! Because it is a work computer it was a bit tricky but eventually I was able to use the 3rd Option to create and use a rescue CD. I was so relieved to see my desktop load up!! Thanks so much!

  8. Hello Stridder,
    It looks like this infection was installed before creating the restore point. In this case I recommend that you try to create a bootable HitmanPro USB or a Kaspersky Rescue Disk as seen in this article.

    If you are still experiencing problems while trying to remove this infection, you can start a thread in our Malware Removal Assistance forum: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Stay safe!

  11. Hello Tom,
    The computer from where I took those screenshot was severely infected, so it’s normal that you had less infections! If you have scanned your machine with HitmanPro and Malwarebytes, then you should have a clean computer.
    Nevertheless, for your peace of mind, you can run a scan with ESET Online Scanner:
    1.Download ESET Online Scanner utility.

    ESET Online Scanner Download Link : http://download.eset.com/special/eos/esetsmartinstaller_enu.exe

    2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).

    3.Check Yes, I accept the Terms of Use, then click the Start button.

    4.Check Scan archives and push the Start button.

    5. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

    6. When the scan completes, click on the Finish button.

  13. Hello Mikey,

    Yes, you should be able to do that. But lets try to see if we can boot from with HitmanPro Kickstart. Try the following:

    1. Make sure that in your BIOS the boot order is configured so that the HDD has priority over the USB flash drive.

    2. During power-up of your computer tap F12/F11/F8/ESC (or another key, depending on your BIOS) to get into the boot-override menu.

    Note that this boot-override menu is NOT the same menu as the boot-configuration menu in your BIOS.

    See also the three screenshots below for examples of how to get into the boot-override menu.

    3. In the boot-override menu, select the USB flash drive to boot from.

    Note: Make sure that the HitmanPro.Kickstart boot loader shows version 1.1 or higher as seen below.

  16. I posted my method how to get rid of Ukash Virus in December 2012 because my computer was attacked by that virus and fixed it with my explained method . On 28th May, 2013 , my another PC was attacked by the same virus but this time my old method did not work at all.

    Let me to tell you a little bit about my old method:

    When system boots up, try to open other programmes to slow down the PC processer and then click on Start – Run and type msconfig and press enter. Go to services tab and disable all services. you will get a message to Restart the Computer press OK or Enter. You have only 5-7 seconds to do all this process before Ukash Virus screen pops up.

    But let me to tell you this method did not work when I tried it on 28th May. The reason is the new Ukash Virus do not let you to do any thing on your PC because it will open automatically other programmes like Windows Media Player etc to slow down the processor. I think the people who develop these nasty things also watch these blogs and website to improve them.

    Any ways, here is the new method.

    Step 1 – Boot the system and continously press F8

    Step 2 – Select Safe Mode with Command Prompt

    Step 3: When DOS Prompt window will come up type cd \ And press enter

    Step 4: The Dos Prompt will look like this

    C: \ >

    type cd windows\pchealth\helpctr\binaries

    Step 5: Type msconfig

    Step 6: Under General Tab: Select Diagnostic Startup – load basic devices and services only

    Step 7: Press Apply and Then Ok

    You will get a message to restart the Computer, press OK

    Now your computer will boot up without Ukash Virus Screen, get MALWAREBYTES ANTI MALWARE AND perform FULL SCAN including any partition on your harddisk, it will kill the virus,

    STEP 8: After deleting the virus , go to Quarantine tab of the MALWAREBYTES and delete the virus from there as well.

    STEP 9: Restart the computer.

    LAST STEP: GO TO START , PRESS RUN AND TYPE MSCONFIG : select NORMAL START UP and apply , and ok

    Thats it.

  18. great advice and it worked like a charm. thank you so much especially to hitman pro it was fast and did the trick! thanks again

  19. Oh you are a brilliant person! When the scam page sprung up on my computer, I got a bit of a fright. Thought I’d restart the comp and see what happened, but of course it was set to push itself to the front on startups. I don’t know why but something made me check my mobile phone (connected to my internet) and type in Ukash just to see if anyone else had heard of it. Thank goodness your page was close to the top of Google… Following the steps seems to have done the trick! Right now I’d happily pay you £100 for putting this godsend of a blog up!

  22. I can’t thank this website and the Hitman Pro product enough. All day it has taken to find a solution but here it is. Hope it coninues to help many others I am thrilled thank you!

  23. I tried Options 1 and 3 but they did not work, so i tried something different.

    I had the problem on an accer laptop running Vista. I pressed the power button and as the computer went to shut down, it closed the Malware screen as part of the shutdown. In the couple of seconds available, I opened a few programs which brought up the “Programs running – do you want to continue shutdown or Cancel” screen. I cancelled and was then able to run my Malwarrebytes!

    Might not work for all, but may be worth a try!

    Thanks for the Help!

  25. I really want to thank you the person who created this blog!! I caught this dumbass Virus on my work computer. If it werent for your help id be stuck explaining everyone I wasnt watching child porn.. EWWW lol . The methods work great! thanks once again and god bless u!!

  26. Many thanks for the tips found here. Given that the virus has been around for a while I wonder why my up to date version of Norton didn’t trap it when I contracted it from an infected website.

  27. Hi,

    Your tips are really helpful.You are the best person.God bless you

    Just want to share that I used a similar strategy today.

    Download malwarebytes on a USB or SD card from a safe computer
    Insert USB or SD card to the infected computer and then turn it on.
    Start pressing F8
    Select Safe Mode with Command Prompt
    At the command prompt, if you are using Windows Vista, 7 or 8 type C:\windows\system32\explorer.exe and then press ENTER.
    Go to your SD or USB drive folder and select the mbam-setup
    Once malwarebytes get installed,start scanning
    After virus detection,remove the infected files and then restart the system.
    Your computer will get unlocked and then you can run a full scan to remove the virus completely.

    I hope this method will help others too.

  28. Thank you thank you thank you :D

    I was completely stuck with this and you have saved me having to take it to an expert :)

    I ended up using method 3

    thank you

  30. Hello Gianni,
    If there is no internet connection, you can try scanning in EWS mode (goto Settings -> Advanced -> Early Warning Scoring and check “I am an Expert”).
    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/anonymous-virus/ , on Method 2.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  31. Hey,

    Unfortunately none of these methods are working for me at the moment. When I try to use HitmanPro Kickstart it says its waiting for an Internet connect even though my pc is connected to the net wirelessly and via an Ethernet cable. How do I fix this?

  32. Good onya Stelian you’re an absolute legend. I used ‘Method 4’ to fix my laptop. Thanks millions mate. Cheers, Rik.

  33. Hi there brother , i got th same problem with ma comp.. lust wana know how many times to do this C:\windows\system32\restore\rstrui.exe, and then press ENTER
    on method 2 please..
    cos i enter yhat code n keep repeating .. thank you..

  34. Wow – thank you so very much. The only thing that can cure the sting of being taken advantage of is the relief of being helped by a kind person(s). Amazing feeling.

  35. Hi,

    You are a saviour to anyone who has gone thru this….I do not know how or why this happened but I was just panicking and not sure what made me search, I came across ur suggestions and was able to get this fixed…..thank you so so much and god bless you…you are surely a saviour if there was one….

    thanks again

  36. Hello Shawn,
    Can you please run a scan with the following tools:
    STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode:

    1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
    2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon,next right click on the Chameleon help file and select “Run As Administrator.Then follow the onscreen instructions to use it.
    3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window.
    4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
    5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
    6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
    7. Upon completion of the scan, if anything has been detected, click on Show Result
    8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
    9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

    STEP 2: Run a scan with RogueKiller

    1. Please download the latest official version of RogueKiller.
      RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
    2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
    3. After the scan has completed, press the Delete button to remove any malicious registry keys.
    4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

    STEP 3 Please perform a scan with HitmanPro as seen on the guide.
    If you are having problems starting this program please use the ForceBreach mode as described in the guide.

    STEP 4: Run a scan with ESET Online Scanner:

    1. Download ESET Online Scanner utility.
      ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
    2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
    3. Check Yes, I accept the Terms of Use
    4. Click the Start button.
    5. Check Scan archives
    6. Push the Start button.
    7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    8. When the scan completes, push Finish

    Waiting for your reply to tell me how everything is running!
    Good luck…

  37. I am having trouble my malwarebytes is a little different and i dont know if that effects it but its taken 9 minutes 10 seconds and its not doing anyrhing

  38. Thanx a lot for all the detailed information.Sick minds dealing wlth these threats should be bang up.Whish u success

  44. hello Stelian,

    I just wanted to say THANK YOU VERY MUCH for providing a step by step process in removing the ukash virus. I would have never been able to do it without your help. i followed all the instructions and managed to get my pc back THANKS TO U.

  45. Thanks for the helpful instructions, managed to unlock the pc with a window restore, now to remove the files.

  46. Thank you so much. The second method worked.

    There are so many scoundrals trying to scam people. At the same time there are also people like you helping others. God Bless You.

  50. Hi Stelian,

    Thanks so much for your assistance , clear instructions on what to do in a moment of panic , i knew it was a scam but couldn’t get rid of it all so thanks again .

    Jeff

  51. Thank you so much!!2nd method works for me. Your easy to follows- instractions helped me so much! so thanks again!!!

  52. THANK YOU!!! It worked with the USB drive, 1&2 method doesn’t seem to work anymore, but anyways follow these instructions and your nasty malware is gone.#
    Happy camper now

  56. Thanks a lot. I had to use method 2. I didn’t know what to do when my computer wouldn’t boot in safe mode.
    Errol

  57. Thank you Stelian
    I was going to pay a fine but I could not??? Do I went on my mobile to googel a solution then I have found your website. Thank you so much. I will pass on your website

  58. Very, clear and thorough instructions when I needed them most. Thanks for taking the time to put these together from a fellow Barca supporter (in Aus).

  59. Dear Stelian,

    You Sir, are a life saver. Many thanks for your information and instructions. They are very effective. System now restored and I’m running a full scan with Panda Security as well as backup to an external drive.

    How come this virus got past my security system?

    Thank you once again and wishing you a very happy and prosperous rest of 2013

    Hx

  61. Stelian – tried again with f11 and nothing happens just here a beep from the laptop. In regard to the link you’ve provided for the kaspersky rescue cd, the link and method 3 just takes me to the hitman USB instructions the same as this article. Appreciate any advice. Thanks

  62. Hello Dan,
    Please try one more time to boot from the HitmanPro USB,pay attention at the booting part and click F11 once your computer starts.
    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  63. Method 1 and 2 don’t work for me and method 3 my windows doesn’t load up and I’m not able to log in. I’m able to access boot options and choose USB but after that my windows doesn’t load up it just freezes on starting windows prompt page before sign in. Please help!!

  65. Thanks so much my friend its good to know that there are genuine people out there to help us computer illiterates, I don’t know what I would have done without your help, I used step 2 system restore and then ran my Mcafee full security scan which found 4 viruses and disinfected them is this enough or do I need to run the malware bytes anti malware too? Please advise when you have a moment and once again Thank you Thank you Thank you

  67. Stelain, you are a king amongst men. Thank you for your easy-to-follow instructions, and may only good things come to you in the future. I will be alerting my friends here in England about this Ukash virus and your solution to it!

    Cheers
    Rich

  68. Thank-you so much! You saved us having to drive two hours to drop off our computer and a huge bill!

  72. Great help got me going again with relative ease.
    Good t know that some people just help people because they can
    Cheers
    Jim

  73. I just wanted to say that you are an absolute legend, i have never been more grateful in my entire life thanks so much!

  76. Thank you, Thank you , and Thankyou again step 3 worked for me, may you be blessed always for all your help x

  77. Hello Gee,
    This message is shown whenever another process is holding a lock on the USB flash drive. Most times this is because there is a window open which shows the contents of the flash drive. Sometimes Windows is configured to show the contents of a flash drive whenever a new one is inserted into the PC. These windows must be closed before the flash drive can be written. Also the failure can occur because of another AV program, inspecting the contents of the flash drive. In that case, waiting a few seconds and then trying to write again will succeed most of the times.

  78. Can anyone please help me I am trying to download hitmanpro kickstart onto my flashdrive when it gets to 100% it stops and ays #5 lock and will not complete the download, my flashdrive is new and has no lock or files on it.

  79. Hello Paul,
    What operating system are you using?
    At the command prompt, Windows Vista and 7 users will type cd restore, and then press ENTER.
    Next,we will type rstrui.exe , and then press ENTER.
    While Windows XP users will need to type C:\windows\system32\restore\rstrui.exe and then press ENTER.

  80. Hello Michael,
    The image that I have used was from a heavily infected machine, and this is why I got more malware. Malwarebytes and HitmanPro are both awesome software and if the scan found only a couple of infections, then that’s ok!
    Malwarebytes and HitmanPro are both have free version and you can uninstall them at any time without any issue! I wouldn’t recommend them if they weren’t good software! :)
    Stay safe!

  85. I don’t know if you’re ever going to read this.

    You sir are an amazing person, and a great fantastic human being. I wish you happiness and the very best in life.

    I used Method 2, the System Restore method, and it worked. Or at least, I think it did.

    Here’s what I’m wondering. It only showed up with 4 infected files. I removed them, but the image has 21 infected files. I know it clearly states that my results will be different from the image. But I’m just wondering.

    And also, if you don’t mind answering for me, do any of these softwares (MalwareBytes, HitmanPro) start charging you after you downloaded the “free version”, and let’s say after sometimes, maybe theres an expiration date on the free version, does it start charging me without my consent???

    Anways, thank you so much for everything. Take care!

  88. Thanks alot, method 2 worked. I had this same $%)$$ing virus several months ago and was able to perform safe with networking. This time only worked with prompt. This virus has gotten stronger since then.

  89. It actually was a member of a domain, so that could have been the issue. Made the rescue CD (had to run it 2x to remove it) and removed some of the files manually, but eventually got it all off and the system reliable.

    Kudos!

  91. None of the methods worked for me. I tried the kickstart method, but when it tried to start in safe mode, any mode I select resulted in the first three files scrolling, and then it locked up. I’ve tried both Kickstart boot modes, and all safe modes, with basically the same result. My guess is that the malware authors have been watching these forums and have added code to block these means of repair.

  92. Thank you very much. I was on my way to make the payment because I live in Denmark and I thought the police got me while downloading some movies. But I said I should check it up before I do anything. Luckely I had my girfriend’s computer close so I did a quick search about this. You’ve saved me 100 euros’. Thanks for that.

  93. Hello Brad,
    Is this your personal computer or a corporate laptop?Please note that HitmanPro does offer free malware removal for home users, however the corporations need to buy this product.
    Anyway,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
    Good Luck!

  95. Really didn’t know what to think when this virus came up!! Definitely though I’d be £100 worse off but thanks to this great site for the help!! Method 2 worked straight away for me and was so easy to follow!! Great website that genuinely offers the best advice!! Thanks again for helping out!!

  96. I wanted to leave this place because I got what I want. But I realized am being selfish for that. If there is anything more than thanks giving you truly deserve it. Thanks alot.

  97. 1&2 didn’t work, and 3 after it found the root kit and the various links to the ransom demands, there was not Activate Free 30 day License – have they changed this now? I downloaded the latest version from the posted links.

  98. Geneous absolutly brilliant no words can describe my gratitude. You are a great person and deserve the best life has to offer

  99. Hello Terry,
    Please try one more time to boot from the HitmanPro USB,pay attention at the booting part and click F11 once your computer starts.
    If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
    If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance

  100. Thank you so much! You saved my new laptop! Easy to use guide & it works so well
    All sorted very quickly

  101. Method 1 and 2 didnt work for me, so I used method 3. But hitmanpro wont start, i only see the ukash virus. Thouhg I did start from my usb with hitmanpro…what to do?

  102. Thank you so much man, I cannot thank you enough. I have to admit I’m a little bit embarrassed about contracting this virus, I always though I was immune to them. Well, I definitely deserved that slap in the face!

    Your instructions were concise, effective, and very easy to understand. I followed it step by step, and I even cleaned up my other computers with the Malware tool. Again, thank you so much, I just bought this computer for $1300, no way was I going to lose it to some jerk fapping away on his laptop to this stupid virus he created.

  103. Thank you, thank you a million times. You just saved my ass, if my roommate came home and found this on his computer…. kart.web.tr lets just say he is alot bigger than me and quick to anger. I dont how i’m gonna repay you man but you definatley earned yourself some good karma. thank you again from a friend in canada.

  105. Fantastic advice. Method 2 worked first time with no problems.

    Thank you very much. Very easy steps to follow

  106. It seems to me u created the virus and u knew how to remove it. Good job in both cases !!! Thanks man ! Just kidding btw

  110. Your a good lad! I use method 2 and it work perfectly. I was shocked at first but as soon as I saw the police were looking for a $100 pay off for “being involved with the distribution of pornographic material, SPAM and copyrighted content.” I new something up. All the same thanks a million for your help much appreciated from down under

  111. WTF!! I was right in the s*#t when those dirty butt worms virused my PC. I found your advice via a work laptop I had brought home so was able to read and perform the very clear and concise step by step instructions. I used method 2 and it appears to have worked a treat. If only you knew how to remove the PEOPLE who create these viruses the world would be a better place! Thank you for your time and expertise, may good things happen to you ;-)

  114. I tried all listed steps and still no results. Kiskstart freeze in middle of loading and I cant do scan. Really frustrated.

  115. OMG!!! God BLESS you guys!!!!!! There’s a spot reserved in the bowels of HELL for A**HOLES who create computer viruses and prey on innocent people. And there is a special spot in HEAVEN you people like you at Malware Tips who help people. Keep up the GREAT WORK guys!!!!!

  116. Great job. Down’t know why many of the other sites complicate this issue. As many others here I thought after trolling the web – oh oh I am done for – but your instructions have saved the day. Thanks very much. I would point out that when accessing system restore it only worked for me when I entered ‘rstrui’ directly after \system 32\ rather than as instructed.

  119. It worked first time through, very good explaination and links to the removal software. Used my mobile phone for instructions.
    Thank you very much!
    Spri1

  120. I thank you! I am not a computor wiz, found your step by step operation easy to follow, yes I was in a panic, thank god for internet phone connection.
    I am filling thia out via phone while waiting for malware to full scan, went for full before I tealised about the quick.
    Think people should be made aware of this scam.
    In relief and much hope. G
    (Thanks for being there!)

  122. You are a life saver. Deadline for uni tomorrow, only took a quick break to watch tv online!! Naughty girl x

  125. Hello Kall,
    Yes, if AVG has definitions for your particular infection , then it can, however Malwarebytes and HitmanPro are products dedicated to malware removal so usually do a better job at cleaning up. Anyway both are free for use,so I see no reason why you shouldn’t try them. :)

  126. Thank you so much! this has been perfect! I’m so busy preparing for exams and this has saved my life! Thank you so much for your help! Merry Xmas and a very very very happy new year! God Bless!

  127. Wish I found your guide earlier. Been trying a few other steps by an antivirus company with little success. This sprung up on Christmas day for me, and I’m sure you’ve saved me countless hours of frustration that I now can spend with my family instead.

    Thank you very much, it is much appreciated.

  128. Thanks mate, your a life saver. I had to go with option 2, its great work to have backup ways to fix the problem.

    Cant thank you enough

  130. Hello Natalie,
    Yes, Malwarebytes and HitmanPro are designed to work alongside NIS 2013… :D
    And for your peace of mind,you can perform a scan with the following tools:
    1.Run a scan with Kaspersky Virus Removal Tool
    1. Click here to download the Kaspersky Virus Removal Tool and double click the setup file to run it.
    2.Follow the onscreen prompts until it is installed
    3.Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
    System Memory
    Hidden startup objects
    Disk boot sectors
    Local Disk (C:)
    Also any other drives (Removable that you may have)

    4.Then click on Actions on the left hand side, click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked.
    5.Click on Automatic ScanStart Scanning button, to run the scan
    2.Run a scan with Eset Online Scanner.

    1.Download ESET Online Scanner utility from here and double click on the Eset installer program (esetsmartinstaller_enu.exe).
    2.Check Yes, I accept the Terms of Use and click the Start button.
    3.Check Scan archives and push the Start button.
    4.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    5.When the scan completes, push Finish
    Stay safe!

  131. Does the Malwarebytes work alongside Norton Security? This virus actually disabled my Norton Security and when I got my computer back on I had to reinstall it. Norton is telling me my computer is safe so do I need to do anything else?

  132. You are a lifesaver! I only had to use method one and it worked! I will 100% recommend this website! Have a very merry christmas!

  133. Thank you very much for these straight-forward and easy instructions to follow. I was able to remove this virus without losing any of my documents.

  134. Hello deep cjs,
    Did you scan with Malwarebytes and HitmanPro, and they didn’t find any threats?If yes,then you’re good to know!
    Stay safe and Merry Christmas!

  135. dude thanks so much i really appreciate your help. so having rebooted the pc, is it normal that when you scan your system there is 0 objects detected?

  137. Thanks so much dude, I thought I was screwed until you helped. Defiantly recommend this for people reading.

  138. Dear Stelian,

    Just a quick line to thank you tremendously for the advice, worked a treat. I only needed to Method 1, but it was reassuring to know there was a contingecy backup if required.

    I will definitely pass your article on to my circle of associates.

    Thanks again, my best regards to you and your family for the Xmas and all the best for 2013.

    Sincerely,

    Peter

  139. Dude if it werent for u i dont know wat i would do
    Hey that rhymed* :P
    well that saved my ass thanks bro ur the best

  140. Thank you, thank you a million times. You just saved my ass, if my roommate came home and found this on his computer…. lets just say he is alot bigger than me and quick to anger. I dont how i’m gonna repay you man but you definatley earned yourself some good karma. thank you again from a friend in canada.

Leave a Comment

Previous

Remove Latvijas Policijas virus (Removal Guide)

Next

Remove Canadian Police Association virus (Removal Guide)