Remove MoneyPak and Paysafecard Ransomware Trojan

If your computer has been locked and you are seeing a notification from the police, asking you to pay a fine via Ukash, MoneyPak or PaySafeCard, then you are reading this article to understand if it’s real and how to get rid of it.
The newest form of attack used by cyber criminals, is a piece of malware called Trojan Reveton, which will display a bogus notification that pretends to be from your local police department, and states that your computer has been blocked due to it being involved with the distribution of pornographic material, SPAM and copyrighted content.
This new form of malware will lock you out of your computer and applications, so whenever you’ll try to log on into your Windows operating system or Safe Mode with Networking, it will display instead a lock screen asking you to pay a non-existing fine in the form of a Ukash or PaySafeCard code.
Furthermore, to make its alert seem more authentic, this virus also has the ability to access your installed webcam so that the bogus Ukash notification shows what is happening in the room.

If your computer is infected with Ukash virus,then you’ll see a notification from your local police department, below you can see just a few examples on how this alerts might look:


The Ukash Ransom is a scam and you should ignore any alert that this malicious software might generate and remove this trojan ransomware from your computer.
Under no circumstance should you send any money to this cyber criminals,as this could lead to identity theft,and if you have, you should request a refund from Ukash stating that you are the victim of a scam and computer virus.

Ukash Police Ransom – Virus Removal Guide

This page is a comprehensive guide, which will remove the Ukash infection from your your computer. Please perform all the steps in the correct order. If you have any questions or doubt at any point STOP and ask for our assistance.
The Ukash will start automatically when you login to your computer and display its screenlocker so that you are unable to access your computer, therefore we will need to remove this infection by using any of the below methods:
OPTION 1: Remove Ukash lock screen virus with System Restore
OPTION 2: Remove Ukash virus with with HitmanPro Kickstart
OPTION 3: Remove Ukash virus with Kaspersky Rescue Disk

OPTION 1: Remove Ukash lock screen virus with System Restore

System Restore helps you restore your computer’s system files to an earlier point in time. It’s a way to undo system changes to your computer without affecting your personal files, such as e‑mail, documents, or photos.
Because the Ukash virus will not allow you to start the computer in Windows regular mode, we will need to start System Restore from the Safe Mode with Command Prompt mode.

STEP 1: Restore Windows to a previous state using System Restore

  1. Reboot your computer into Safe Mode with Command Prompt. To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard.
    [Image: F8 key]
    If you are using Windows 8, the trick is to hold the Shift button and gently tap the F8 key repeatedly, this will sometimes boot you into the new advanced “recovery mode”, where you can choose to see advanced repair options. On the next screen, you will need to click on the Troubleshoot option, then select Advanced Options and select Windows Startup Settings. Click on the Restart button, and you should now be able to see the Advanced Boot Options screen.
  2. Using the arrow keys on your keyboard, select Safe Mode with Command Prompt and press Enter on your keyboard.
    [Image: Starting computer in Safe Mode with Command Prompt]
  3. At the command prompt, type rstrui.exe, and then press ENTER.
    [Image: Start System Restore to remove lock screen virus]
    Alternatively, if you are using Windows Vista, 7 and 8, you can type: C:\windows\system32\rstrui.exe , and press Enter. And if you are a Windows XP user, type C:\windows\system32\restore\rstrui.exe, then press Enter.
  4. System Restore should start, and you will display also a list of restore points. Try using a restore point created just before the date and time the Ukash lock screen virus has infected your computer.
    [Image: Restore settings to remove ransomware]
  5. When System Restore has completed its task, start your computer in Windows regular mode, and perform a scan with Malwarebytes Anti-Malware and HitmanPro, as seen in the next step.

STEP 2: Remove Ukash malicious files with Malwarebytes Anti-Malware Free

Even after using System Restore,

  1. You can download Malwarebytes Anti-Malware Free from the below link, then double-click on the icon named mbam-setup.exe to install this program.
    MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK(This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
  2. When the installation begins, keep following the prompts in order to continue with the setup process, then at the last screen click on the Finish button.
    [Image: Malwarebytes Anti-Malware final installation screen]
  3. On the Scanner tab, select Perform quick scan, and then click on the Scan button to start searching for the Ukash malicious files.
    [Image: Malwarebytes Anti-Malware Quick Scan]
  4. Malwarebytes’ Anti-Malware will now start scanning your computer for Ukash virus as shown below.
    [Image: Malwarebytes Anti-Malware scanning for Ukash
  5. When the Malwarebytes Anti-Malware scan has finished, click on the Show Results button.
    [Image: Malwarebytes Anti-Malware scan results]
  6. You will now be presented with a screen showing you the computer infections that Malwarebytes Anti-Malware has detected. Make sure that everything is Checked (ticked), then click on the Remove Selected button.
    [Image: Malwarebytes Anti-Malwar removing Ukash virus]

STEP 3: Double-check for the Ukash virus with HitmanPro

  1. You can download HitmanPro from the below link:
    HITMANPRO DOWNLOAD LINK (This link will open a web page from where you can download HitmanPro)
  2. Double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows). When the program starts you will be presented with the start screen as shown below.
    HitmanPro scanner
    Click on the Next button, to install HitmanPro on your computer.
    HitmanPro installation
  3. HitmanPro will now begin to scan your computer for Ukash malicious files.
    HitmanPro detecting for Ukash virus
  4. When it has finished it will display a list of all the malware that the program found as shown in the image below. Click on the Next button, to remove Ukash virus.
    HitmanPro scan results
  5. Click on the Activate free license button to begin the free 30 days trial, and remove all the malicious files from your computer.
    [Image: HitmanPro 30 days activation button]

OPTION 2: Remove Ukash virus with with HitmanPro Kickstart

If you cannot start your computer into Safe Mode with Command Prompt mode, we can use the HitmanPro Kickstart program to bypass Ukash lock screen.
As the Ukash ransomware infection locks you out of your computer, you will need to create a bootable USB drive that contains the HitmanPro Kickstart program.
We will then boot your computer using this bootable USB drive and use it to clean the infection so that you are able to access Windows normally again.
You will also need a USB drive, which will have all of its data erased and will then be formatted. Therefore, only use a USB drive that does not contain any important data.

  1. Using a “clean” (non-infected) computer, please download HitmanPro Kickstart from the below link.
    HITMANPRO DOWNLOAD LINK (This link will open a download page in a new web page from where you can download HitmanPro Kickstart)
  2. Once HitmanPro has been downloaded, please insert the USB flash drive that you would like to erase and use for the installation of HitmanPro Kickstart. Then double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows).
    To create a bootable HitmanPro USB drive, please follow the instructions from this video:
  3. Now, remove the HitmanPro Kickstart USB drive and insert it into the Ukash infected computer.
  4. Once you have inserted the HitmanPro Kickstart USB drive, turn off the infected computer and then turn it on. As soon as you power it on, look for text on the screen that tells you how to access the boot menu.
    [Image: Windows Boot Menu screens]
    The keys that are commonly associated with enabling the boot menu are F10, F11 or F12.
  5. Once you determine the proper key (usually the F11 key) that you need to press to access the Boot Menu, restart your computer again and start immediately tapping that key. Next, please perform a scan with HitmanPro Kickstart as shown in the video below.
  6. HitmanPro will now reboot your computer and Windows should start normally. Then please Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

OPTION 3: Remove Ukash virus with Kaspersky Rescue Disk

If any of the above methods did not clean your infected computer, we can use a Kaspersky Rescue Disk Bootable to clean the Windows registry and to perform a system scan to remove the Ukash virus.
To create a bootable Kaspersky Rescue Disk, we will need the following items:

  • A clean (non-infected) computer with Internet access
  • A blank DVD or CD
  • A computer with a DVD or CD burner

STEP 1: Download and create a bootable Kaspersky Rescue Disk CD

  1. You can download Kaspersky Rescue Disk utility from link below:
    KASPERSKY RESCUE DISK DOWNLOAD LINK (This link will automatically download Kaspersky Rescue Disk (kav_rescue_10.iso) on your computer.)
  2. To create the bootable rescue disk, we will need to use the ImgBurn program. You can download ImgBurn from the below link, then install this program.
    IMGBURN DOWNLOAD LINK (This link will open a new page from where you can download the ImgBurn program)
  3. Insert your blank DVD or CD in your burner, then start ImgBurn and click on the Write image file to disc button.
  4. Under Source click on the Browse for file button, then navigate to the location where you previously saved the Kaspersky Rescue Disk utility (kav_rescue_10.iso), then click on the Write button.
    [Image: Bootable Kaspersky Rescue CD]
    That’s it, ImgBurn will now begin writing your bootable Kaspersky Rescue Disk.

STEP 2: Start your computer using the Kaspersky Rescue Disk

  1. Once you’ve got the Kasperky Rescue Disk in hand, insert it into the infected computer, and turn off and then turn it on again.
  2. As soon as you power it on, you will see a screen that tells you to press any key to enter the menu, so please tap any key to boot your machine from the Kaspersky Rescue Disk.
    [Image: Starting infected computer from Kaspersky Rescue Disk]
  3. In the next screen, you will need to chose a language, then you click on Kaspersky Rescue Disk. Graphic Mode and press ENTER, to start the Kaspersky Rescue Disk.[Image: Kaspersky Rescue Disk Graphic Mode screen]

STEP 3: Scan your system with Kaspersky Rescue Disk

  1. Within a few short seconds you should see the full working environment, with the Kaspersky Rescue Disk screen front and center as shown below.
    [Image: Kaspersky Rescue Disk scanner]
  2. Switch tabs over to the My Update Center, and then click the Start update button to load the latest anti-virus definitions. Please be patience while this process its completed.
    [Image: Updating Kaspersky Rescue Disk antivirus definitions]
  3. Switch back over to the Objects Scan tab, select the drives you want to scan, and then click the Start Objects Scan button.
    [Image: Kaspersky Rescue Disk scan]
  4. When Kaspersky Antivirus will detect the Ukash virus, you’ll be prompted to select an action. When this happens, please select Quarantine or Delete to remove this infection from your computer.
    [Image: Kaspersky Rescue Disk prompt]
  5. When the antivirus scan has completed, you can restart back into Windows regular mode, by clicking on the Kaspersky Start button [Image: Kaspersky Rescue Disk Restart button] (lower left corner), and selecting Restart.
    Once your computer will start in Windows regular more, download Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

Your computer should now be free of the Ukash infection. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.
If you are still experiencing problems while trying to remove Ukash virus from your machine, please start a new thread in our Malware Removal Assistance forum.

IT’S YOUR TURN TO HELP!

If we have managed to help with your computer issues, then please let other people know that this article will help them!
You can share this article on Facebook,Twitter or Google Plus by using the below buttons.

ABOUT STELIAN PILICI

I am the creator and owner of MalwareTips.com.
My area of expertise includes malware removal and computer forensics. I'm active in the various online anti-malware communities where I do researches for new malware threats as they are released.
I live in Bucharest (Romania), where I run my own local computer repair shop.
I repair both hardware and other operating systems related issues, however most of my business is malware related problems.

You can follow me on Google+ , and I will keep you up-to-date with the latest computer infections and malware threats.

SUPPORT MALWARETIPS! (OPTIONAL)

All our malware removal guides and utilities are completely free!
We do not request any kind of payment for our services, however if you like to support us with our website costs, you can make a small donation. Any amount is appreciated, and will support our fight against malware.
  • Brandie

    THANK YOU, THANK YOU, THANK YOU!! Your help was clear, precise and so helpful! I’m not very computer savvy, but your instruction’s get me straightened out when I thought things were pretty scary.

  • Samina

    Thank you. You made my day.

  • http://malwaretips.com/ Stelian Pilici

    Hello Bob,
    Have you tried to create the bootable HitmanPro USB stick or Kaspersky Rescue Disk?

  • Howard

    Thanks for your help. I appreciate it.

  • Diarmuid

    Stelian. You are a lifesaver.
    I managed to remove the virus using System Restore on a compaq presario running XP sp3. To get to safe mode, I had to hit F8 almost as soon as I switched the computer on. I was then given the option of logging on as Administrator (which doesn’t usually appear) – and I did and followed your instructions for restoring the system and removing the virus. Phew!
    Very relieved and very very grateful. Many thanks

  • Joel

    Hey, This virus hit me on my work laptop and in my line of work, the things that were on there were so horrible that I was packing death! Because it is a work computer it was a bit tricky but eventually I was able to use the 3rd Option to create and use a rescue CD. I was so relieved to see my desktop load up!! Thanks so much!

  • http://malwaretips.com/ Stelian Pilici

    Hello Milo,
    If these cyber criminals have not used the Ukash code yet, you can request a refund from here: https://www.ukash.com/en-GB/support/faqs/?cat=644

    Also, if you are from the US, you can submit a complaint to the FTC, and you should get you money back eventually : http://www.ftc.gov/ftc/contact.shtm

    If you are from outside the US, you can submit a complaint at your local police department.
    Stay safe!!

  • Stridder

    Hey so I just performed the system restore and it’s still locked ?

    • http://malwaretips.com/ Stelian Pilici

      Hello Stridder,
      It looks like this infection was installed before creating the restore point. In this case I recommend that you try to create a bootable HitmanPro USB or a Kaspersky Rescue Disk as seen in this article.

      If you are still experiencing problems while trying to remove this infection, you can start a thread in our Malware Removal Assistance forum: http://malwaretips.com/Forum-Malware-Removal-Assistance
      Stay safe!

  • http://malwaretips.com/ Stelian Pilici

    Hello Murat,
    Please create a HitmanPro Kickstart USB as seen here: http://malwaretips.com/blogs/remove-police-trojan/#hitmanpro
    OR
    Please create a bootable Kaspersky Rescue Disk as seen here: http://malwaretips.com/blogs/remove-police-trojan/#kaspersky

    Stay safe!

  • http://malwaretips.com/ Stelian Pilici

    Hello Tom,
    The computer from where I took those screenshot was severely infected, so it’s normal that you had less infections! If you have scanned your machine with HitmanPro and Malwarebytes, then you should have a clean computer.
    Nevertheless, for your peace of mind, you can run a scan with ESET Online Scanner:
    1.Download ESET Online Scanner utility.

    ESET Online Scanner Download Link : http://download.eset.com/special/eos/esetsmartinstaller_enu.exe

    2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).

    3.Check Yes, I accept the Terms of Use, then click the Start button.

    4.Check Scan archives and push the Start button.

    5. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

    6. When the scan completes, click on the Finish button.

  • Chris L

    Brilliant advice , worked a treat. Thanks

  • http://malwaretips.com/ Stelian Pilici

    Hello Mikey,

    Yes, you should be able to do that. But lets try to see if we can boot from with HitmanPro Kickstart. Try the following:

    1. Make sure that in your BIOS the boot order is configured so that the HDD has priority over the USB flash drive.

    2. During power-up of your computer tap F12/F11/F8/ESC (or another key, depending on your BIOS) to get into the boot-override menu.

    Note that this boot-override menu is NOT the same menu as the boot-configuration menu in your BIOS.

    See also the three screenshots below for examples of how to get into the boot-override menu.

    3. In the boot-override menu, select the USB flash drive to boot from.

    Note: Make sure that the HitmanPro.Kickstart boot loader shows version 1.1 or higher as seen below.

  • http://malwaretips.com/ Stelian Pilici

    Hello Mikey,
    Please create a Kaspersky Rescue Disk and scan your computer for malware, as seen here: http://malwaretips.com/blogs/remove-police-trojan/#kaspersky

  • http://malwaretips.com/ Stelian Pilici

    Hello Martin,
    You will need to create a Kaspersky Rescue Disk, and perform a system scan.
    You have here the instructions: http://malwaretips.com/blogs/how-to-use-kaspersky-rescue-disk/

  • Maverick

    I posted my method how to get rid of Ukash Virus in December 2012 because my computer was attacked by that virus and fixed it with my explained method . On 28th May, 2013 , my another PC was attacked by the same virus but this time my old method did not work at all.

    Let me to tell you a little bit about my old method:

    When system boots up, try to open other programmes to slow down the PC processer and then click on Start – Run and type msconfig and press enter. Go to services tab and disable all services. you will get a message to Restart the Computer press OK or Enter. You have only 5-7 seconds to do all this process before Ukash Virus screen pops up.

    But let me to tell you this method did not work when I tried it on 28th May. The reason is the new Ukash Virus do not let you to do any thing on your PC because it will open automatically other programmes like Windows Media Player etc to slow down the processor. I think the people who develop these nasty things also watch these blogs and website to improve them.

    Any ways, here is the new method.

    Step 1 – Boot the system and continously press F8

    Step 2 – Select Safe Mode with Command Prompt

    Step 3: When DOS Prompt window will come up type cd \ And press enter

    Step 4: The Dos Prompt will look like this

    C: \ >

    type cd windows\pchealth\helpctr\binaries

    Step 5: Type msconfig

    Step 6: Under General Tab: Select Diagnostic Startup – load basic devices and services only

    Step 7: Press Apply and Then Ok

    You will get a message to restart the Computer, press OK

    Now your computer will boot up without Ukash Virus Screen, get MALWAREBYTES ANTI MALWARE AND perform FULL SCAN including any partition on your harddisk, it will kill the virus,

    STEP 8: After deleting the virus , go to Quarantine tab of the MALWAREBYTES and delete the virus from there as well.

    STEP 9: Restart the computer.

    LAST STEP: GO TO START , PRESS RUN AND TYPE MSCONFIG : select NORMAL START UP and apply , and ok

    Thats it.

  • José Brañez

    Than you so much! This hints saved us!

  • Aaron P.

    great advice and it worked like a charm. thank you so much especially to hitman pro it was fast and did the trick! thanks again

  • Brian Kirk

    Oh you are a brilliant person! When the scam page sprung up on my computer, I got a bit of a fright. Thought I’d restart the comp and see what happened, but of course it was set to push itself to the front on startups. I don’t know why but something made me check my mobile phone (connected to my internet) and type in Ukash just to see if anyone else had heard of it. Thank goodness your page was close to the top of Google… Following the steps seems to have done the trick! Right now I’d happily pay you £100 for putting this godsend of a blog up!

  • faisal

    hi these tips really very good thanks you very much help for these tips
    Allah bless you

  • joe

    thanks for that man u saved me 100 pound method 2 worked for me

  • Laura

    I can’t thank this website and the Hitman Pro product enough. All day it has taken to find a solution but here it is. Hope it coninues to help many others I am thrilled thank you!

  • David

    I tried Options 1 and 3 but they did not work, so i tried something different.

    I had the problem on an accer laptop running Vista. I pressed the power button and as the computer went to shut down, it closed the Malware screen as part of the shutdown. In the couple of seconds available, I opened a few programs which brought up the “Programs running – do you want to continue shutdown or Cancel” screen. I cancelled and was then able to run my Malwarrebytes!

    Might not work for all, but may be worth a try!

    Thanks for the Help!

  • fritz

    thank you, your explications are helpful
    my computer is now clean.

  • Ali

    I really want to thank you the person who created this blog!! I caught this dumbass Virus on my work computer. If it werent for your help id be stuck explaining everyone I wasnt watching child porn.. EWWW lol . The methods work great! thanks once again and god bless u!!

  • Bob

    Many thanks for the tips found here. Given that the virus has been around for a while I wonder why my up to date version of Norton didn’t trap it when I contracted it from an infected website.

  • Saver

    Hi,

    Your tips are really helpful.You are the best person.God bless you

    Just want to share that I used a similar strategy today.

    Download malwarebytes on a USB or SD card from a safe computer
    Insert USB or SD card to the infected computer and then turn it on.
    Start pressing F8
    Select Safe Mode with Command Prompt
    At the command prompt, if you are using Windows Vista, 7 or 8 type C:\windows\system32\explorer.exe and then press ENTER.
    Go to your SD or USB drive folder and select the mbam-setup
    Once malwarebytes get installed,start scanning
    After virus detection,remove the infected files and then restart the system.
    Your computer will get unlocked and then you can run a full scan to remove the virus completely.

    I hope this method will help others too.

  • pete

    Thank you thank you thank you :D

    I was completely stuck with this and you have saved me having to take it to an expert :)

    I ended up using method 3

    thank you

  • Gianni

    Hey,

    Unfortunately none of these methods are working for me at the moment. When I try to use HitmanPro Kickstart it says its waiting for an Internet connect even though my pc is connected to the net wirelessly and via an Ethernet cable. How do I fix this?

    • http://malwaretips.com/ Stelian Pilici

      Hello Gianni,
      If there is no internet connection, you can try scanning in EWS mode (goto Settings -> Advanced -> Early Warning Scoring and check “I am an Expert”).
      If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/anonymous-virus/ , on Method 2.
      If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
      Good Luck!

  • Rik

    Good onya Stelian you’re an absolute legend. I used ‘Method 4′ to fix my laptop. Thanks millions mate. Cheers, Rik.

  • Sa

    Hi there brother , i got th same problem with ma comp.. lust wana know how many times to do this C:\windows\system32\restore\rstrui.exe, and then press ENTER
    on method 2 please..
    cos i enter yhat code n keep repeating .. thank you..

    • http://malwaretips.com/ Stelian Pilici

      Hello Sa,
      What operating system are you using?

  • Woody

    Wow – thank you so very much. The only thing that can cure the sting of being taken advantage of is the relief of being helped by a kind person(s). Amazing feeling.

  • Al

    Hi,

    You are a saviour to anyone who has gone thru this….I do not know how or why this happened but I was just panicking and not sure what made me search, I came across ur suggestions and was able to get this fixed…..thank you so so much and god bless you…you are surely a saviour if there was one….

    thanks again

  • Shawn

    I am having trouble my malwarebytes is a little different and i dont know if that effects it but its taken 9 minutes 10 seconds and its not doing anyrhing

    • http://malwaretips.com/ Stelian Pilici

      Hello Shawn,
      Can you please run a scan with the following tools:
      STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode:

      1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
      2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon,next right click on the Chameleon help file and select “Run As Administrator.Then follow the onscreen instructions to use it.
      3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window.
      4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
      5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
      6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
      7. Upon completion of the scan, if anything has been detected, click on Show Result
      8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
      9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

      STEP 2: Run a scan with RogueKiller

      1. Please download the latest official version of RogueKiller.
        RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
      2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
      3. After the scan has completed, press the Delete button to remove any malicious registry keys.
      4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

      STEP 3 Please perform a scan with HitmanPro as seen on the guide.
      If you are having problems starting this program please use the ForceBreach mode as described in the guide.


      STEP 4: Run a scan with ESET Online Scanner:

      1. Download ESET Online Scanner utility.
        ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      Waiting for your reply to tell me how everything is running!
      Good luck…

  • James Strews

    Thanx a lot for all the detailed information.Sick minds dealing wlth these threats should be bang up.Whish u success

  • neale

    Thank you very much second method worked for me ,you are a star

  • Milad

    Thanks so much!

  • Qthefun

    Can not thank you enough! You have been the light at the end of a tunnel!

  • phew!

    Thank you so much for this! Really!

  • Andrew

    Thank you for clear concise removal instructions..your a legend!

  • zahzah

    hello Stelian,

    I just wanted to say THANK YOU VERY MUCH for providing a step by step process in removing the ukash virus. I would have never been able to do it without your help. i followed all the instructions and managed to get my pc back THANKS TO U.

  • Wayne

    Thanks for the helpful instructions, managed to unlock the pc with a window restore, now to remove the files.

  • RAM CHARI

    Thank you so much. The second method worked.

    There are so many scoundrals trying to scam people. At the same time there are also people like you helping others. God Bless You.

  • sayga

    you are the best of the best,thank you very much you save may $100.thank you again

  • hangwi tang

    Hi Stelian,

    You are an absolute legend. Thanks so much.

    cheers
    hwi

  • panos

    Thank town solved the problem

  • jeff

    Hi Stelian,

    Thanks so much for your assistance , clear instructions on what to do in a moment of panic , i knew it was a scam but couldn’t get rid of it all so thanks again .

    Jeff

  • ioanna

    Thank you so much!!2nd method works for me. Your easy to follows- instractions helped me so much! so thanks again!!!

  • Mike

    THANK YOU!!! It worked with the USB drive, 1&2 method doesn’t seem to work anymore, but anyways follow these instructions and your nasty malware is gone.#
    Happy camper now

  • George

    This helpe me! Thank you so much !!

  • brian

    thanks took a few attempts but got there in the end.
    well done stelian

  • Dan Heeris

    Dear Stelian
    Thank You and do you mind if I refer to you as GOD.
    and once again Thank You

  • Errol

    Thanks a lot. I had to use method 2. I didn’t know what to do when my computer wouldn’t boot in safe mode.
    Errol

  • Stockers

    Very, clear and thorough instructions when I needed them most. Thanks for taking the time to put these together from a fellow Barca supporter (in Aus).

  • Harmony

    Dear Stelian,

    You Sir, are a life saver. Many thanks for your information and instructions. They are very effective. System now restored and I’m running a full scan with Panda Security as well as backup to an external drive.

    How come this virus got past my security system?

    Thank you once again and wishing you a very happy and prosperous rest of 2013

    Hx

    • pat

      Thank you Stelian
      I was going to pay a fine but I could not??? Do I went on my mobile to googel a solution then I have found your website. Thank you so much. I will pass on your website

  • Dan

    Method 1 and 2 don’t work for me and method 3 my windows doesn’t load up and I’m not able to log in. I’m able to access boot options and choose USB but after that my windows doesn’t load up it just freezes on starting windows prompt page before sign in. Please help!!

    • Stelian Pilici

      Hello Dan,
      Please try one more time to boot from the HitmanPro USB,pay attention at the booting part and click F11 once your computer starts.
      If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
      If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
      Good Luck!

      • Dan

        Stelian – tried again with f11 and nothing happens just here a beep from the laptop. In regard to the link you’ve provided for the kaspersky rescue cd, the link and method 3 just takes me to the hitman USB instructions the same as this article. Appreciate any advice. Thanks

  • chez

    Stelian,
    thanks so much for your help. Words can’t describe how grateful I am for your advice :)

  • Neil

    Thanks so much my friend its good to know that there are genuine people out there to help us computer illiterates, I don’t know what I would have done without your help, I used step 2 system restore and then ran my Mcafee full security scan which found 4 viruses and disinfected them is this enough or do I need to run the malware bytes anti malware too? Please advise when you have a moment and once again Thank you Thank you Thank you

  • Rich

    Sorry, I mistyped your name. Stelian was what I meant!

  • Rich

    Stelain, you are a king amongst men. Thank you for your easy-to-follow instructions, and may only good things come to you in the future. I will be alerting my friends here in England about this Ukash virus and your solution to it!

    Cheers
    Rich

  • Brad and Jennlren

    Thank-you so much! You saved us having to drive two hours to drop off our computer and a huge bill!

  • Carl

    You are the BEST!!! Thank you !!!! Do what this genius says to do to fix this damn virus.

  • craigmill

    Many, many thanks – very clear and easy to follow.
    I used the system restore method.

  • Marie

    I dont know how i CAN thank you enough!!!!! THANKS

  • Jim

    Great help got me going again with relative ease.
    Good t know that some people just help people because they can
    Cheers
    Jim

  • Sean

    I just wanted to say that you are an absolute legend, i have never been more grateful in my entire life thanks so much!

  • Declan

    simple clear effective

    say no more

    declan

  • smartfart

    Just wanted to say four words…Thank you very much.

  • Arijeet

    Thank you for ur help.3rd step work for me.ones again thank you.

    • Gee

      Can anyone please help me I am trying to download hitmanpro kickstart onto my flashdrive when it gets to 100% it stops and ays #5 lock and will not complete the download, my flashdrive is new and has no lock or files on it.

      • Stelian Pilici

        Hello Gee,
        This message is shown whenever another process is holding a lock on the USB flash drive. Most times this is because there is a window open which shows the contents of the flash drive. Sometimes Windows is configured to show the contents of a flash drive whenever a new one is inserted into the PC. These windows must be closed before the flash drive can be written. Also the failure can occur because of another AV program, inspecting the contents of the flash drive. In that case, waiting a few seconds and then trying to write again will succeed most of the times.

    • Gee

      Thank you, Thank you , and Thankyou again step 3 worked for me, may you be blessed always for all your help x

  • Beaye

    good adivice thanks more

  • Beaye

    you are great man you saved my 100 euro go head like that.

  • rol

    Cheers seems to have worked a treat….the wonderful world of you-tube and its tutuorials A+++++++

  • Michael

    I don’t know if you’re ever going to read this.

    You sir are an amazing person, and a great fantastic human being. I wish you happiness and the very best in life.

    I used Method 2, the System Restore method, and it worked. Or at least, I think it did.

    Here’s what I’m wondering. It only showed up with 4 infected files. I removed them, but the image has 21 infected files. I know it clearly states that my results will be different from the image. But I’m just wondering.

    And also, if you don’t mind answering for me, do any of these softwares (MalwareBytes, HitmanPro) start charging you after you downloaded the “free version”, and let’s say after sometimes, maybe theres an expiration date on the free version, does it start charging me without my consent???

    Anways, thank you so much for everything. Take care!

    • Stelian Pilici

      Hello Michael,
      The image that I have used was from a heavily infected machine, and this is why I got more malware. Malwarebytes and HitmanPro are both awesome software and if the scan found only a couple of infections, then that’s ok!
      Malwarebytes and HitmanPro are both have free version and you can uninstall them at any time without any issue! I wouldn’t recommend them if they weren’t good software! :)
      Stay safe!

  • paul

    tryed the restore>rstrui.exe an it tells me access denied

    • Stelian Pilici

      Hello Paul,
      What operating system are you using?
      At the command prompt, Windows Vista and 7 users will type cd restore, and then press ENTER.
      Next,we will type rstrui.exe , and then press ENTER.
      While Windows XP users will need to type C:\windows\system32\restore\rstrui.exe and then press ENTER.

  • Sheesh

    Method 1 worked for me. Thanks!

  • Greg

    Thanks! worked like a charm

    • Jared

      Thanks alot, method 2 worked. I had this same $%)$$ing virus several months ago and was able to perform safe with networking. This time only worked with prompt. This virus has gotten stronger since then.

  • Dave

    None of the methods worked for me. I tried the kickstart method, but when it tried to start in safe mode, any mode I select resulted in the first three files scrolling, and then it locked up. I’ve tried both Kickstart boot modes, and all safe modes, with basically the same result. My guess is that the malware authors have been watching these forums and have added code to block these means of repair.

  • zmeu

    Thank you very much. I was on my way to make the payment because I live in Denmark and I thought the police got me while downloading some movies. But I said I should check it up before I do anything. Luckely I had my girfriend’s computer close so I did a quick search about this. You’ve saved me 100 euros’. Thanks for that.

  • Liviu

    Instructions worked excellent on my computer.

  • Max

    Really didn’t know what to think when this virus came up!! Definitely though I’d be £100 worse off but thanks to this great site for the help!! Method 2 worked straight away for me and was so easy to follow!! Great website that genuinely offers the best advice!! Thanks again for helping out!!

  • golfa

    I wanted to leave this place because I got what I want. But I realized am being selfish for that. If there is anything more than thanks giving you truly deserve it. Thanks alot.

  • Brad Kiefer

    1&2 didn’t work, and 3 after it found the root kit and the various links to the ransom demands, there was not Activate Free 30 day License – have they changed this now? I downloaded the latest version from the posted links.

    • Stelian Pilici

      Hello Brad,
      Is this your personal computer or a corporate laptop?Please note that HitmanPro does offer free malware removal for home users, however the corporations need to buy this product.
      Anyway,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
      If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance
      Good Luck!

      • Brad Kiefer

        It actually was a member of a domain, so that could have been the issue. Made the rescue CD (had to run it 2x to remove it) and removed some of the files manually, but eventually got it all off and the system reliable.

        Kudos!

  • Greg

    Geneous absolutly brilliant no words can describe my gratitude. You are a great person and deserve the best life has to offer

  • Terry

    Method 1 and 2 didnt work for me, so I used method 3. But hitmanpro wont start, i only see the ukash virus. Thouhg I did start from my usb with hitmanpro…what to do?

    • Stelian Pilici

      Hello Terry,
      Please try one more time to boot from the HitmanPro USB,pay attention at the booting part and click F11 once your computer starts.
      If it still doesn’t work,you’ll need to create a Kaspersky Rescue CD as seen HERE: http://malwaretips.com/blogs/remove-police-trojan/ , on Method 3.
      If everything fails, then you’ll need to create an account on our forums and a member of the staff will help you (with more advanced tools) to remove this nasty virus: http://malwaretips.com/Forum-Malware-Removal-Assistance

  • Zach

    Thank you so much man, I cannot thank you enough. I have to admit I’m a little bit embarrassed about contracting this virus, I always though I was immune to them. Well, I definitely deserved that slap in the face!

    Your instructions were concise, effective, and very easy to understand. I followed it step by step, and I even cleaned up my other computers with the Malware tool. Again, thank you so much, I just bought this computer for $1300, no way was I going to lose it to some jerk fapping away on his laptop to this stupid virus he created.

  • irfan

    Thank you, thank you a million times. You just saved my ass, if my roommate came home and found this on his computer…. kart.web.tr lets just say he is alot bigger than me and quick to anger. I dont how i’m gonna repay you man but you definatley earned yourself some good karma. thank you again from a friend in canada.

  • luke

    i cant access internet to complete scan? any ideas?

  • Catto

    Fantastic advice. Method 2 worked first time with no problems.

    Thank you very much. Very easy steps to follow

  • Demes

    It seems to me u created the virus and u knew how to remove it. Good job in both cases !!! Thanks man ! Just kidding btw

  • Benthomas

    Thanks so much. The Second version worked grand for me.

  • Jim

    How long does it take to run system restore.

    • Stelian Pilici

      Hello,
      It depends on the size of your hard drive, usually no more that 15 minutes or so…

  • Dan

    Your a good lad! I use method 2 and it work perfectly. I was shocked at first but as soon as I saw the police were looking for a $100 pay off for “being involved with the distribution of pornographic material, SPAM and copyrighted content.” I new something up. All the same thanks a million for your help much appreciated from down under

  • Chris

    WTF!! I was right in the s*#t when those dirty butt worms virused my PC. I found your advice via a work laptop I had brought home so was able to read and perform the very clear and concise step by step instructions. I used method 2 and it appears to have worked a treat. If only you knew how to remove the PEOPLE who create these viruses the world would be a better place! Thank you for your time and expertise, may good things happen to you ;-)

  • annabella

    Seems to have worked!!!! Thanks a ton man! I used the first option.

  • allias

    I tried all listed steps and still no results. Kiskstart freeze in middle of loading and I cant do scan. Really frustrated.

  • Rick

    OMG!!! God BLESS you guys!!!!!! There’s a spot reserved in the bowels of HELL for A**HOLES who create computer viruses and prey on innocent people. And there is a special spot in HEAVEN you people like you at Malware Tips who help people. Keep up the GREAT WORK guys!!!!!

  • finbin

    Great job. Down’t know why many of the other sites complicate this issue. As many others here I thought after trolling the web – oh oh I am done for – but your instructions have saved the day. Thanks very much. I would point out that when accessing system restore it only worked for me when I entered ‘rstrui’ directly after \system 32\ rather than as instructed.

  • Andy

    Ive had this 3 times now … Just a prompt for afuol reboot this time

  • Herman

    THANK YOU VERY VERY MUCH, MATE!!!
    I couldn’t do it without your help.

  • Sprione

    It worked first time through, very good explaination and links to the removal software. Used my mobile phone for instructions.
    Thank you very much!
    Spri1

  • Graham Trudgeon

    I thank you! I am not a computor wiz, found your step by step operation easy to follow, yes I was in a panic, thank god for internet phone connection.
    I am filling thia out via phone while waiting for malware to full scan, went for full before I tealised about the quick.
    Think people should be made aware of this scam.
    In relief and much hope. G
    (Thanks for being there!)

  • Ernst

    Used Method 2 : Restore Windows followed by Step 2 : Scan with Malwarebytes

  • Suzie

    You are a life saver. Deadline for uni tomorrow, only took a quick break to watch tv online!! Naughty girl x

  • Burton Haynes

    Awesome!!!Thanks.
    PS. Used System Restore to remove this virus!

  • Stelian Pilici

    Hello Kall,
    Yes, if AVG has definitions for your particular infection , then it can, however Malwarebytes and HitmanPro are products dedicated to malware removal so usually do a better job at cleaning up. Anyway both are free for use,so I see no reason why you shouldn’t try them. :)

    • Kall

      Many thanks. They were needed and worked fine. Your help is greatly appreciated.

  • Syed

    Thank you so much! this has been perfect! I’m so busy preparing for exams and this has saved my life! Thank you so much for your help! Merry Xmas and a very very very happy new year! God Bless!

  • Magne

    Wish I found your guide earlier. Been trying a few other steps by an antivirus company with little success. This sprung up on Christmas day for me, and I’m sure you’ve saved me countless hours of frustration that I now can spend with my family instead.

    Thank you very much, it is much appreciated.

  • Ash

    Thanks mate, your a life saver. I had to go with option 2, its great work to have backup ways to fix the problem.

    Cant thank you enough

  • Natalie

    Does the Malwarebytes work alongside Norton Security? This virus actually disabled my Norton Security and when I got my computer back on I had to reinstall it. Norton is telling me my computer is safe so do I need to do anything else?

    • Stelian Pilici

      Hello Natalie,
      Yes, Malwarebytes and HitmanPro are designed to work alongside NIS 2013… :D
      And for your peace of mind,you can perform a scan with the following tools:
      1.Run a scan with Kaspersky Virus Removal Tool
      1. Click here to download the Kaspersky Virus Removal Tool and double click the setup file to run it.
      2.Follow the onscreen prompts until it is installed
      3.Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
      System Memory
      Hidden startup objects
      Disk boot sectors
      Local Disk (C:)
      Also any other drives (Removable that you may have)

      4.Then click on Actions on the left hand side, click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked.
      5.Click on Automatic ScanStart Scanning button, to run the scan
      2.Run a scan with Eset Online Scanner.

      1.Download ESET Online Scanner utility from here and double click on the Eset installer program (esetsmartinstaller_enu.exe).
      2.Check Yes, I accept the Terms of Use and click the Start button.
      3.Check Scan archives and push the Start button.
      4.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      5.When the scan completes, push Finish
      Stay safe!

      • Natalie

        Brilliant, thanks for your help! They all say my laptop is now secure!

      • Jack

        Thank you so much! You saved my new laptop! Easy to use guide & it works so well
        All sorted very quickly

  • Emma

    You are a lifesaver! I only had to use method one and it worked! I will 100% recommend this website! Have a very merry christmas!

  • Natalie

    Thank you very much for these straight-forward and easy instructions to follow. I was able to remove this virus without losing any of my documents.

  • deep cjs

    dude thanks so much i really appreciate your help. so having rebooted the pc, is it normal that when you scan your system there is 0 objects detected?

    • Stelian Pilici

      Hello deep cjs,
      Did you scan with Malwarebytes and HitmanPro, and they didn’t find any threats?If yes,then you’re good to know!
      Stay safe and Merry Christmas!

  • Mariana Pilakoutas

    THANK YOU it worked straight away and I recommend this website to anyone with a virus

  • Jedd

    Thanks so much dude, I thought I was screwed until you helped. Defiantly recommend this for people reading.

  • Peter Calder

    Dear Stelian,

    Just a quick line to thank you tremendously for the advice, worked a treat. I only needed to Method 1, but it was reassuring to know there was a contingecy backup if required.

    I will definitely pass your article on to my circle of associates.

    Thanks again, my best regards to you and your family for the Xmas and all the best for 2013.

    Sincerely,

    Peter

  • myhero

    Thank you, thank you a million times. You just saved my ass, if my roommate came home and found this on his computer…. lets just say he is alot bigger than me and quick to anger. I dont how i’m gonna repay you man but you definatley earned yourself some good karma. thank you again from a friend in canada.

    • jack

      Dude if it werent for u i dont know wat i would do
      Hey that rhymed* :P
      well that saved my ass thanks bro ur the best