UKash - Metropolitan Police Virus Scam

UKash - Metropolitan Police Virus Scam is doing a re-run in the UK, and recently hit one of our customers PC's who was very distressed and upset by the experience. I'm only posting this is an advisory in case anyone else gets caught out with this.

Our customer (probably like many computer users) had failed to really keep his internet security up to date, but whilst surfing YouTube he clicked on an external link, and inadvertently in doing so, downloaded the Ukash virus. It is a trojan -

Basically the virus installs on your system, and then it locks the computer up with a screen saying Metropolitan Police - Your computer has been locked.
The screen information displays your computer IP and other information that might make you think (if you do have your wits about you) that this is quite a genuine thing. Obviously the giveaway is if you pay them a £100 using any of the methods show, then an unlock code will be sent to you.

This is a scam that happened a few years ago in Germany and has been modified and released again. If you type this into Google Search:

"ukash virus metropolitan police"

You will note that there have been a spate of recent attacks using this virus. Removal needs to be done with care, and using Safe Mode - even then it takes a bit of weeding out.

Just to advise anyone who may be interested

If you receive such a message on your computer, then please DO NOT MAKE ANY PAYMENT. This is a scam using a trojan horse virus. No-one has discovered any so called illegal material on your computer, but removal procedures need to be done to remove the virus using Safe Mode, otherwise the virus remains on your system. If you think your computer has been compromised by this or any other scam, please contact us for informed advice and support.

Hi Josh

Sorry we missed your post.
To remove (or attempt removal) of this UKash Scam follow the suggested steps:

1. Shut down your computer
2. Restart the computer and as it is booting up press F8 repeatedly - you should bring on a black screen similar to this:
   
   
   
   Select Safe Mode with Networking and then hit Enter
3. Once the computer has started in safe mode download Malwarebytes Anti-Malware Free - download link: http://www.malwarebytes.org/products/malwarebytes_free
4. Install the software on your system and then run a FULL system scan. It should find the corrupted files and quarantine or remove them.
5. Restart the computer normally and you should be good to go

Let us know if this solved the problem

Hi guevara68

We would suspect that the encryption is setup to prevent safe mode logins. You should try safe mode with networking first. If this does not work then as it is a works laptop, and it is encrypted, you may have to refer it to your IT department to have it checked.

The information below is given as a guide only - if the laptop contains important data then you are advised to contact the IT department who are responsible for your works laptop!!!

If you can login using the normal method then is there an option for you to disable the encryption on the laptop?

To help answer your question better, which version of Windows are you running, and what type of encryption does the laptop use?

Have you managed to sort the problem?