HELP my daughter laptop has a Ukash locked screen!

She has been sent a screen saying her laptop is locked.
In the top right is a Metropolitan Police label.

The Ip address 82.27.197.178

IS THIS A VIRUS OR BONAFIDE????

It s asking for £100 to unlock her laptop and all her TMAs from the Open University is on it.

What do we do? Mcafee is suppose to be on her pc.

Ukash Virus is an aggressive group of ransomware scams that tries to swindle your money from you. It is a very convincing virus because it uses alerts presented as given by an official institution, e.g. local or country’s police

get your google boots on, looks like its quite fixable.good luck.

Thanks we nearly had a heart attack.

try rebooting.

rebooting into safe mode

adjust bios boot order and;

booting with windows cd

booting with hirens boot cd

format

oh yeah..i know this fraud of a trojan, had about a dozen computers infected within a network that read that you have been surfing porn and you need to pay 100 euros for the computer to be unlocked or else face jail time. I was loling so hard when they rang me. Actually i was asking " was the porn viewed worth 100euros, if so, simply pay up" their response was " wtf are you mad or drunk "

Anyway, you will need to boot into safe mode and you will find a particular file nested on your desktop along with a recent reg key. As mentioned above, if you goolge the step by step you should be rolling in about 10mins again.

Originally posted by Kino321
Ukash Virus is an aggressive group of ransomware scams that tries to swindle your money from you. It is a very convincing virus because it uses alerts presented as given by an official institution, e.g. local or country’s police

However, demanding money rather undermines the credibility.
Official requests for bribery are not quite so blatant.

I don't think it's going to take 10 min I am good at some things but fixing PC probs I'm not.

We have looked up how to boot in safe mode I believe it says press F8 key.
Which we did.
It still keeps going to the Ukash page after booting up.

Atually my pc has been acting funny too but it could be overheating, as it hibernated all night long last night.
I thought I had turned it off.

I have McAfee too.

i still need help.

reply to post by AriesJedi

Here's a guide from Mcafee.

That should walk you through it. It is a virus - it is not legit. It's called ransomware.

~Heff

I have followed instructions from Spyhunter's malware remover for this ukash virus.

We got as far as installing the program but Windows popped up and said the administrator won't let that procedure happen.

Is this the worse case scenario?

reply to post by AriesJedi


If you're on a laptop and it won't let you have administrative powers then you have to log in under the admin account on it.

Try this link - but scroll past all of the "download" section and reach the "manual removal" instructions. This one's a bit more user friendly.

~Heff

When she boots up there are two administrators, shall we try the other one?
You see she is on my hubby's cast off.

I have asked my hubby to buy her a new one but he seems to have gone apathetic.

Thanks for staying on, we are still panicking.

Tried both the administrator account and her named account on her pc.

It is the system administrator that is preventing this installation so I can't download the program to fix the virus.

What can I do now?

reply to post by Hefficide


Thankyou as I am in UK it is now 1.15am and she is getting tired. I will have to see if I can do it tonight or I will try tomorrow but your help has been invaluble.

You will see I have started another thread about 4 men breaking into our home and that also occurred at midnight.

Think we are being targeted.

reply to post by AriesJedi


If you can't into Windows through safe mode during load ( as described above ) then you'll need the reinstall disc that came with the computer - or you'll have to find somebody locally who can network to your system and get in that way.

~Heff

I have followed the instructions on that last link and we can not get into exactly the same Admin area on the command prompt.
Cocuments and setting/ADMIN/.....
We have no idea how to get to this.

Ours comes up with Windows system32..
We got to the shell and it was already Explorer.exe

SO I think we will have to take it to the local pc repairers.


I hate life at the moment.

Thanks everyone I will report back when it is fixed or if they get the hard drive contents off and hubby finally buys her new one.

reply to post by AriesJedi


You can try AVG for FREE AVG

I would download Hirens Boot CD and write it to a blank DVD and then boot off this on the infected laptop.

It will bypass the infected system and load up a temp version of Mini XP that has a whole bunch of anti-virus tools already installed on it. Then you can scan for the infection and get rid of it if possible.

the anitvirus tools it contains are :

Avira AntiVir Personal (07-12-2011) Free anti-virus and anti-spyware on-demand scanner, detects and removes more than 50000 viruses and trojans.

ClamWin Free Antivirus 0.97.3 (07-12-2011) A free antivirus, GNU GPL Open Source Virus Scanner.

ComboFix (07-12-2011) Designed to cleanup malware infections and restore settings modified by malware.
Dr.Web CureIt! Antivirus a free standalone anti-virus and anti-spyware on-demand scanner (downloadable).

GMER 1.0.15 Hidden services, hidden registry, hidden file scanner, Rootkit Detector and Remover.

Malwarebytes Anti-Malware 1.51.1 (07-12-2011) anti-malware application that can thoroughly remove even the most advanced malware.

Remove Fake Antivirus 1.82 a tool to remove virus/malware which disguises itself to be an antivirus and produces fake alert/warnings and urge you to purchase a useless copy of the fake antivirus.

RootkitRevealer 1.7.1 Rootkit Revealer is an advanced patent-pending root kit detection utility.

Spybot - Search & Destroy 1.6.2 (07-12-2011) Application to scan for spyware, adware, hijackers and other malicious software.

SuperAntispyware 5.0.1134 (07-12-2011) Remove Adware, Malware, Parasites, Rootkits, Spyware, Trojan, and Worms (a must have tool).

TDSSKiller 2.6.21.0 To remove malware belonging to the family Rootkit.Win32.TDSS aka Tidserv, TDSServ and Alureon.

You can download it from here

After I spent 1.5 hours last night on it and still didn't fix it, my hubby came in tonight and did a system restore.
We have lift off Houston.

Apparently she had Virgin anti virus-ie RUBBISH.

We will be getting Norton AV and I will nag him silly to get her a new laptop.

Life is a bit better.

Thanks members for all your help and suggestions you kept us sane whilst my daughter was panicking. We have now backed up her TMAs/essays for her degree in the Open University. And we are going to get her an external hardrive too.
Lesson learnt.

See you.

Hi AriesJedi. I'm glad to hear that you were able to back up your daughter's documents.

I'd just like to point out that if you do purchase Norton, your daughter could encounter problems using the university's online resources. Of course, this depends on many things such as the product purchased as well as the university's configuration of said resources. At the universities I've worked for, we would have to uninstall paid versions of Norton from student machines just so the students could finish their homework. We began recommending/installing Microsoft Security Essentials, SuperAntiSpyware Free Edition, and Malwarebytes Free Edition on student's machines due to the unobtrusiveness and effectiveness of these programs.

In any case, I would recommend you try out one of the top free anti-virus solutions out there, such as Microsoft Security Essentials, Avira, Avast, or Panda. The virus protecting capabilities of these free options rival that of paid options, such as Norton, and will protect your daughter's computer without slowing it down or cause any conflicts with the university's resources.

No matter what anti-virus solution you choose, I would recommend also installing SuperAntiSpyware Free Edition and Malwarebytes Free Edition. These free tools will remove most malware infections painlessly.

I hope this helps.