Fake Police Virus Warning? How to Unlock Your PC and Remove the Infection

If your computer is locked, and you are seeing a “Your computer has been blocked” notification from a law enforcement agency (FBI, Australian Federal Police, Metropolitan Police, U.S. Department of Justice) asking you to pay a fine via GreenDot MoneyPak, Ukash or Paysafecard code, you are seeing a police impersonation scam. Older Windows screen-locking infections included Trojan Reveton, but a webpage with this message does not by itself identify that malware.

If only the browser is blocked: press Esc to leave full screen, then close the tab. If it will not close, press Ctrl + Shift + Esc, select the browser in Task Manager, and choose End task. Reopen it without restoring the scam tab. Use the recovery options below if Windows itself remains locked or you ran a downloaded file.

The Police Ukash or Moneypak virus is distributed through several means. Malicious websites, or legitimate websites that have been hacked, can infect your machine through exploit kits that use vulnerabilities on your computer to install this trojan without your permission or knowledge. Another method used to propagate this type of malware is spam email containing infected attachments or links to malicious websites. Cybercriminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link embedded inside the email). And with that, your computer is infected with the Police Ukash or Moneypak virus. The threat may also be downloaded manually by tricking the user into thinking they are installing a useful piece of software, for instance a bogus update for Adobe Flash Player or another piece of software. The Police Ukash or Moneypak virus is also prevalent on peer-to-peer file sharing websites and is often packaged with pirated or illegally acquired software. Once installed on your computer, the Police Ukash or Moneypak virus will display a bogus notification that pretends to be from an official law enforcement agency (examples: Irish An Garda Síochána, Royal Canadian Mounted Police, Police Central e-crime Unit) and states that your computer has been blocked due to it being involved with the distribution of pornographic material, SPAM and copyrighted content. The Police Ukash or Moneypak virus will lock you out of your computer and applications, so whenever you’ll try to log on into your Windows operating system or Safe Mode with Networking, it will display instead a lock screen asking you to pay a non-existing fine of  in the form of a Moneypak, Ukash or Paysafecard voucher. Furthermore, to make this alert seem more authentic, this virus also has the ability to access your installed webcam, so that the bogus Police Ukash or Moneypak notification shows what is happening in the room. The Police Ukash or Moneypak virus locks the computer and depending on the user’s current location, displays a localized webpage that covers the entire desktop of the infected computer and demands payment for the supposed possession of illicit material. Cyber criminals often updated the design of this lock screen, however you should always keep in mind that Police Ukash or Moneypak will never lock down your computer or monitor your online activities. The message displayed by the threat can be localized depending on the user’s location, with text written in the appropriate language. The Police Ukash or Moneypak lock screen is a scam, and you should ignore any alerts that this malicious software might generate. Under no circumstance should you send any Greendot Moneypak, Paysafecard or Ukash code to these cyber criminals, and if you have, contact the payment provider immediately and ask whether the payment can be stopped or refunded, stating that you are the victim of a computer virus and scam.

Remove any Police Ukash,MoneyPak or PaySafecard virus

This page is a comprehensive guide, which will remove the Police Ukash or Moneypak infection from your computer. Please perform all the steps in the correct order. If you have any questions or doubt at any point STOP and ask for our assistance. The Police Ukash or Moneypak will start automatically when you login to your computer and display its screenlocker so that you are unable to access your computer, therefore we will need to remove this infection by using any of the below methods: OPTION 1: Remove Police Ukash or Moneypak lock screen virus with System Restore OPTION 2: Start Windows in Safe Mode and run the removal tools OPTION 3: Remove Police Ukash or Moneypak virus with Kaspersky Rescue Disk

OPTION 1: Remove Police Ukash or Moneypak lock screen virus with System Restore

System Restore helps you restore your computer’s system files to an earlier point in time. It’s a way to undo system changes to your computer without affecting your personal files, such as e‑mail, documents, or photos. If the lock screen prevents normal access, open Windows Recovery Environment to use System Restore. On Windows 10 and 11, use the recovery menu below rather than repeatedly pressing F8. Have the BitLocker recovery key for this PC ready if it is requested.

STEP 1: Restore Windows to a previous state using System Restore

1. At the Windows sign-in screen, hold Shift while choosing Power → Restart. If Windows already shows Automatic Repair, choose Advanced options. If you cannot reach either screen, boot from official Windows installation media and choose Repair your computer.

   On an older Windows 7 PC, F8 may still open Advanced Boot Options. Windows 10 and 11 normally use the recovery menu above; do not keep interrupting startup to chase the old menu.

2. Choose Troubleshoot → Advanced options → System Restore. Select your Windows installation and account if asked, and unlock the drive with its recovery key if prompted.
3. Click Next in System Restore and choose a restore point from before the lock screen appeared. If no restore point is available, cancel and try another recovery option; do not create a new restore point expecting it to undo an existing infection.

   The older rstrui.exe command opens System Restore from a working Windows session or a compatible Safe Mode session. You do not need that command when you opened System Restore through the recovery menu.

4. System Restore should start, and you will display also a list of restore points. Try using a restore point created just before the date and time the Police Ukash or Moneypak lock screen virus has infected your computer.
5. When System Restore has completed its task, start your computer in Windows regular mode, and perform a scan with Malwarebytes Anti-Malware and HitmanPro, as seen in the next step.

STEP 2: Remove Police Ukash or Moneypak malicious files with Malwarebytes Anti-Malware Free

Malwarebytes Anti-Malware Free uses industry-leading technology to detect and remove all traces of malware, including worms, Trojans, rootkits, rogues, dialers, spyware, and more. It is important to note that Malwarebytes Anti-Malware works well and should run alongside antivirus software without conflicts.

1. You can download download Malwarebytes Anti-Malware from the below link. Download MalwarebytesFree official installer. Your download starts right away.
2. Save your work, open Downloads, and double-click the current MBSetup installer. Approve the Windows prompt only after checking that it identifies Malwarebytes. You may be presented with a User Account Control dialog asking you if you want to run this file. If this happens, you should click “Yes” to continue with the installation.
3. When the installation begins, you will see the Malwarebytes Anti-Malware Setup Wizard which will guide you through the installation process. To install Malwarebytes Anti-Malware on your machine, keep following the prompts by clicking the “Next” button.
4. Open Malwarebytes and click Scan on the dashboard. The normal Threat Scan checks common malware locations. If setup offers a subscription or optional browser extension, review it and skip offers you do not want. For a targeted scan, open the scanner options and choose Custom Scan; a rootkit check is optional there and is unavailable on Windows ARM.
5. Allow Malwarebytes to update its detection database before the scan. If the update fails, check your connection and retry; record any error instead of assuming that old definitions are current.
6. Malwarebytes Anti-Malware will now start scanning your computer for the pop-up virus. When Malwarebytes Anti-Malware is scanning it will look like the image below.
7. When scanning finishes, review the detected items. Leave confirmed threats selected and click Quarantine. Save the report if you need help assessing an item before excluding or restoring it. Please note that the infections found may be different than what is shown in the image.
8. Malwarebytes Anti-Malware will now quarantine all the malicious files and registry keys that it has found. When removing the files, Malwarebytes Anti-Malware may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot your computer, please allow it to do so. After your computer will restart, you should open Malwarebytes Anti-Malware and perform another “Threat Scan” scan to verify that there are no remaining threats

STEP 3: Double-check for the Police Ukash or Moneypak virus with HitmanPro

HitmanPro is a second opinion scanner, designed to rescue your computer from malware (viruses, trojans, rootkits, etc.) that have infected your computer despite all the security measures you have taken (such as anti virus software, firewalls, etc.). HitmanPro is designed to work alongside existing security programs without any conflicts. It scans the computer quickly (less than 5 minutes) and does not slow down the computer.

1. You can download HitmanPro from the below link: Download HitmanProOfficial Sophos download. Free scan, free 30-day trial to remove threats.
2. Double-click on the file named “HitmanPro.exe” (for 32-bit versions of Windows) or “HitmanPro_x64.exe” (for 64-bit versions of Windows). When the program starts you will be presented with the start screen as shown below. Click on the “Next” button, to install HitmanPro on your computer.
3. HitmanPro will now begin to scan your computer for any malicious files that may be on your machine.
4. When it has finished it will display a list of all the malware that the program found as shown in the image below. Click on the “Next” button, to remove any virus that has been found.
5. If this PC is eligible, click Activate free license and follow the prompts for the one-time 30-day trial. If it was already used, an existing paid license is required for removal; scanning remains free. Keep the report if you need help deciding what to remove.

---

OPTION 2: Start Windows in Safe Mode and run the removal tools

If System Restore is unavailable, try Safe Mode to reach Windows without the screen locker starting normally. The older HitmanPro Kickstart USB instructions do not describe the current HitmanPro download. Do not look for a Kickstart USB button or download an old copy from an unofficial site.

1. Open the recovery menu.

   At the sign-in screen, hold Shift and choose Power → Restart. If you cannot reach it, use Advanced options on the Automatic Repair screen, or boot Windows installation media and choose Repair your computer. Keep your BitLocker recovery key available.

2. Start Safe Mode.

   Select Troubleshoot → Advanced options → Startup Settings → Restart. Press 4 or F4 for Safe Mode. If you need online scanner updates, 5 or F5 requests Safe Mode with Networking, although Wi-Fi may be unavailable.

3. Sign in and run a scan.

   You may need your account password rather than your PIN. Run the Malwarebytes steps above. If a scanner cannot install or work in Safe Mode, do not keep forcing it; use the rescue-disk option or ask for removal help. A clean computer can be used to download the installer to a USB drive, but that does not make the installer a bootable rescue disk.

4. Use HitmanPro when Windows can run it.

   The download below is the normal Windows scanner. Follow the HitmanPro steps above when it runs successfully and has a working connection for cloud checks. Removal requires an eligible trial or a license.

   Download HitmanProOfficial Sophos download. Free scan, free 30-day trial to remove threats.

5. Restart into normal Windows and check again.

   After quarantining detected threats, restart normally. Confirm that the lock screen is gone and review the scan reports. If it returns, save the exact detection names and ask for help instead of paying the demand. If files are also encrypted, preserve the ransom note and encrypted originals before attempting recovery.

OPTION 3: Remove Police Ukash or Moneypak virus with Kaspersky Rescue Disk

If any of the above methods did not clean your infected computer, we can use a Kaspersky Rescue Disk Bootable to clean the Windows registry and to perform a system scan to remove the Police Ukash or Moneypak virus. To create a bootable Kaspersky Rescue Disk, we will need the following items:

• A clean (non-infected) computer with Internet access
• A blank DVD or CD
• A computer with a DVD or CD burner

STEP 1: Download and create a bootable Kaspersky Rescue Disk CD

1. You can download Kaspersky Rescue Disk utility from link below: Download Kaspersky Rescue DiskOpens the download page in a new tab.
2. To create the bootable rescue disk, we will need to use the ImgBurn program. You can download ImgBurn from the below link, then install this program. Download ImgBurnOpens the download page in a new tab.
3. Insert your blank DVD or CD in your burner, then start ImgBurn and click on the Write image file to disc button.
4. Under Source click on the Browse for file button, then navigate to the location where you previously saved the Kaspersky Rescue Disk utility (krd.iso), then click on the Write button. That’s it, ImgBurn will now begin writing your bootable Kaspersky Rescue Disk.

STEP 2: Start your computer using the Kaspersky Rescue Disk

1. Once you’ve got the Kasperky Rescue Disk in hand, insert it into the infected computer, and turn off and then turn it on again.
2. Choose the USB drive or DVD from the computer’s one-time Boot Menu, using the key specified by its manufacturer. Follow the rescue startup prompts and choose your language.
3. Choose Graphic mode and wait for the rescue environment to load. If that mode fails, try Limited graphic mode. Read and accept the displayed agreements if you agree.

STEP 3: Scan your system with Kaspersky Rescue Disk

1. Wait for Kaspersky Rescue Tool to open. If the Windows drive uses BitLocker, unlock it with your recovery key or other supported credentials; do not format it.
2. If the tool reports outdated databases, click Update now, let the download finish, and restart the scanning application if prompted. You can check the database date in About.
3. Review the scan scope, include the Windows drive you intend to check, and click Start scan. Let it finish and review the results.
4. Review each detection and the proposed action. Use disinfection when available for an infected system file; do not blindly delete Windows components. Save the report and seek help if you cannot assess a detection.
5. When the antivirus scan has completed, you can restart back into Windows regular mode, by clicking on the Kaspersky Start button (lower left corner), and selecting Restart. Once your computer will start in Windows regular more, download Malwarebytes Anti-Malware and HitmanPro, and scan your computer for any left over infections.

---

Your computer should now be free of the Police Ukash or Moneypak infection. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future, and perform regular computer scans with HitmanPro. If you are still experiencing problems while trying to remove Police Ukash or Moneypak virus from your machine, please start a new thread in our Malware Removal Assistance forum.