What is Ukash Virus?
Ukash Virus is a dangerous and widely-spread infection. Its' main purpose is to lock your PC and demand for a release fee of 100 GBP/EUR (or a similar amount in your local currency). This Ukash Virus has spread all around the world with different names in each country:
- FBI MoneyPak virus in the USA,
- Metropolitan Police Ukash Virus or Specialist Crime Directorate Police Central e-crime Unit Virus in the UK,
- AFP (Australian Federal Police) Ukash Virus in Australia,
- Federal Department of Justice and Police Ukash Virus in Switzerland,
- Gendarmerie Nationale Ukash Virus in France,
- Federal Computer Crime Unit Ukash Virus in Belgium.
Scroll to Ukash Virus removal guide ∇
The behaviour is identical in most of such viruses:
- It shows your country and current IP address;
- Ukash Virus displays your picture if you have a webcam installed;
- Uses Ukash prepaid cards as a means to pay a fine for the supposed violations;
- Disguises under the name of your local authority to make you believe it is a legitimate warning.
Please ignore all messages displayed by this virus and remove it as soon as possible as having one installed may also endanger your PC to other possible infections.
We advise you to use a reputable anti-spyware solution, because it is capable of removing such alerts and messages as well as any other remains of the Ukash Virus that may exist on your computer.
How to remove Ukash Virus and "Your computer has been locked!" message?
Most Ukash variations in different countries have the same behavior and SpyHunter can remove it in a matter of a few minutes. Please follow the instructions below to remove "Your computer has been locked!" message and all Ukash-related files from your computer.
You can also follow our video guides:
Automated Ukash Virus removal instructions
-
Restart your computer into Safe Mode:
-
When your computer is booting up, keep pressing F8 key until you see the screen, pictured below:
- Choose "Safe Mode with Networking"
-
When your computer is booting up, keep pressing F8 key until you see the screen, pictured below:
- Windows XP only: when your computer is started, open Start menu, select "Run". If you don't see "Run" item there, pressing WIN+R key kombination on your keyboard might help. In the Run window type "msconfig" (without quotes), hit ENTER. Switch to Startup tab and click "Disable All" button. Restart your PC into normal mode.
-
Download SpyHunter to remove Ukash Virus:
Download Ukash Virus removal tool
or type in the following URL: http://removepcinfection.com/sh
Read more about SpyHunter and how to install it - Install SpyHunter by double-clicking on the installed file and follow the on-screen instructions.
Alternate Automated Ukash Virus removal instructions
If for any reason the method above does not work, please read the following instructions to effectively remove Ukash Virus:
-
Restart your computer into Safe Mode:
-
When your computer is booting up, keep pressing F8 key until you see the screen, pictured below:
- Choose "Safe Mode with Command Prompt"
-
When your computer is booting up, keep pressing F8 key until you see the screen, pictured below:
- When your computer boots up in Safe Mode, a commant prompt will show up. In the command prompt, type "explorer" (without quotes) and hit ENTER key. Explorer window will open up. Do not close it yet.
-
In the command prompt window type "regedit" (without quotes) and hit ENTER key. Windows Registry Editor will open up. In the left side of Registry Editor window, navigate to the following path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\See the following image for help:
- Right-click on the Shell item and select "Modify…".
- Under the "Value data" you should see "explorer.exe", if it is named otherwise, modify it so that it would read "explorer.exe".
-
Close all windows and restart your computer. When the computer boots up, download SpyHunter:
Download Ukash Virus removal tool
or type in the following URL: http://removepcinfection.com/sh
Read more about SpyHunter and how to install it - Install SpyHunter by double-clicking on the installed file and follow the on-screen instructions.
Video Guides To Get Rid of Ukash Virus
Ukash Virus Removal on Windows XP
Ukash Virus Removal on Windows 7
Manual Ukash Virus removal instructions
Note: manual Ukash Virus removal is recommended to experienced computer users only.
In order to remove Ukash Virus from your computer, do the following:
-
Stop the following Ukash Virus processes (refer to our guide how to use Windows Task Manager to kill any malicious process):
- %WINDIR%\system32\0_0u_l.exe
- %TEMP%\wpbt0.dll
-
Remove the following files from your system:
- %Temp%\[random].exe
- %StartupFolder%\ctfmon.lnk
- %WINDIR%\system32\0_0u_l.exe
- %TEMP%\wpbt0.dll
Please note that by following the steps above, only core Ukash Virus files and starting points will be removed. We highly recommend an automated removal, because SpyHunter can also kill and delete all processes and files related to Ukash Virus virus. It also features a proactive protection to prevent any further attacks against your computer.
how can i restart my computer if virus is blocking access to start menu, and the restart option?
If you can’t access Start Menu (and most certainly you can’t if the virus is active), you have to force-restart your computer. If your computer is desktop, reset your PC by pushing the RESET button on your computer case. If you have a laptop, power it off by holding power button 5-7 seconds (until it powers off completely) and then start it again. I hope it helps.
thanx, spy hunter did the trick!
Thank you SO much for the help!:)
hey what happens if the spyhunter say its crashed and it wont work?
In this case, you may want to try an alternative solution:
I hope it runs this time 🙂
Hello Adam,
We seem to have got this met police virus this week from our daughter downloading music/movies.
I have tried the various methods above to remove but unfortunately they have not worked.
When going into safe mode/safe mode with networking or safe mode with command prompt it starts to scroll through lines of text then stops and reboots, not allowing any further progess.
It is on xp home with Kapersky security.
It lets us get as far as the log in page and then after clicking on the user (either ours or our daughters) within around five seconds of seeing the desktop the warning page pops up with no time to run anything – I have tried!
Any ideas on a way forward?
Thanks,
Ian
Hello Ian,
unfortunately you PC is heavily infected. You will have to make some additional steps to remove the infection. If you have access to any other computer with Internet connection, you may follow the steps I will describe here in this comment. Otherwise, I’m afraid you will have to bring the PC to the repair.
This method uses a free Ubuntu operating system that you will use to download and install SpyHunter into your infected computer. You will need a DVD burner and a blank DVD disk to burn Ubuntu into.
If you manage to launch the installer, the lock screen should not appear anymore (as the installer may kill any suspicious applications running).
Personally I'd use the Ubuntu DVD to remove the core virus files as described above. I'd then set about finding out which other files are involved and remove them.
Starting in ‘Safe Mode’ rersults in running through a few of the items which list when starting in this mode and then auto rebooting to start over.
Back to square one!
Is there another way?
Hello John,
please try the solution posted in reply to Ian’s comment.
I can’t start up my laptop in safe mode how else can I do above, I have no use of my desktop at all!
Hello Becky,
please try the instructions described in reply to Ian’s comment.
Hi
I’ve followed the steps on with the command prompt, restarted but the virus is still blocking the computer … help????
Hello Beth,
try restarting to Safe Mode with Networking an navigate to http://removepcinfection.com/sh to download SpyHunter.
If that does not work, try the instructions in reply to Emily’s comment.
Please how do I avoid this virus? It has locked my computer twice and I have paid a lot of money. What can I do to stop it from coming again?
Hello Martina,
I’m very sorry you had to go through this. If you decide to purchase SpyHunter, you will have an active protection in the future. If you ever get infected again, you can always restart your computer into Safe Mode and launch SpyHunter to remove the virus.
Ukash Virus uses various exploits to get inside your computer, but there are ways to reduce the chance of getting it in the future:
Please, can you help me to get rid of this virus in my Vista laptop?
Hello Isabel.
Have you tried following these instructions above? If so, have encountered any issues trying to get rid of the Ukash Virus? Please let me know and I will try to help you.
Hi
I have tried to start pc in safe mode with command when I hit enter it says please select the operating system to start with and it highlights windows xp professional ! What do I do next please ? Thanks in advance
Hello Beverley.
In this window, select whichever is your main operating system and press ENTER. In your case, that would be “Windows XP Professional” I suppose.
If you do have several operating systems installed, select the one you think is your primary. If that does not work, try the other.
It then takes me straight to the windows start up screen and
I can’t do anything else
Sorry I meant to say I can’t type
In the run bar as virus takes over before I can type anything
In that case, try selecting Safe Mode with Command Prompt and follow the alternate removal directions. If the virus is still popping up before you can do anything, try the following:
Let me know if that helps 🙂
Just want to say ” your a star
Dear Adam,
do i absolutely have to start my PC in safe mode before I download the Spyhunter? I am totally unfamiliar with boot menues and have no clue how to get rid of the thing. I am currently writing you from the infected PC from the guest account. I need a very easy and very quick solution. Pleeeaaase :).
Miriam
Hi
I have got the ukask virus on my computer. It is a vista home premium so I tried the alternitive way to get rid of it as I couldn’t find one for vista but it didn’t work. Please help me.
Thank you your informstion helped me fix the ukash problem bless u
Hi we had the police virus on our computer. We didnt know it was a virus and thought it was genuine. So we payed them. Is there a way of getting our money back?
Hi Nia,
I’m afraid you won’t be able to get your money back because it is extremely difficult to track such purchases, as far as I know. That’s the main reason why the hackers decided to use Ukash cards to scam people.
I need help: My aunts pc is infected and i need to get rid of the virus, but i dont want to get our home network infected, and i dont know how aggresive the virus is. long story short: i cant connect to the internet. And the virus dont show up if not connected to the internet.
Hi Christoph,
Ukash virus should not spread into your other network computers. If you’re able to access either Safe Mode with Networking, or Safe Mode with Command Prompt, you can easily remove Ukash virus by following our instructions above. Just make sure you get internet access on your aunt’s computer.
Or you could unplug the network cable until the computer is fully booted in Safe Mode, and then connect the cable and download SpyHunter to completely get rid of the virus.
I have gone into safe mode, but I cannot access explorer to download Ukash virus removal tool. your help is appreciated. thank you
Hello Marilyn,
does Internet Explorer launch at all when you click on its’ icon? Or do you not even see the icon? You can also get the fix tool by entering the address in the “Run” dialog. To initiate “Run” dialog, hit WIN+R key combination on your keyboard.
I am using Windows 7
hi i've got this same problem with ukash and have been trying to get rid of it but as soon as i restart my laptop and start it with same mode with networking my laptop turns on for 5 seconds then it says logging off and turns itself off and back on and starts on with windows normally and then my laptop gets blocked again and i cant get rid of ukash.
so please can you help please?
Hello Ayesha,
if “Safe Mode with Networking” does not work, please try “Safe Mode with Command Prompt” mode, which is described in the alternate removal guide here.
Hi
I have a HP laptop windows 7 with the Ukash virus. I normally start the laptop with a finger scanner. When I try to start in safe modes the finger scanner is disabled and it asks for a password which I cant remember, and never created a key disc because I just used the scanner. Is there anything you can suggest?
Many thanks
Hi Mike,
unfortunately you will have to reset your Windows 7 password before you can get into Safe Mode. It is quite a lengthy process if you haven’t done this before. You can read about resetting Windows password here: http://pcsupport.about.com/od/windows7/ss/windows-7-password-reset-walkthrough.htm.
Would you believe I have this virus on my Ubuntu Firefox. Can you tell me what to do
Hi Sal,
does your Ubuntu system have all the symptoms described in this article? It is very unlikely that Ukash virus is operating on Ubuntu system because it is solely targeted at Windows users. It might just be the browser settings that could have been affected by the virus.
All worked but had to do a system restore first by selecting repair computer option after pressing F8. Otherwise virus returned to block screen. Thanks for the tips though – it does work.