Computer Locked - Ukash Virus

Also Known As: Ukash Ransomware
Type: Ransomware
Damage level: Severe
Distribution: Moderate
Damage Level

Computer Locked (Ukash Virus) - how to unlock your PC?

What is Computer Locked - Ukash?

Deceptive messages demanding payment of fines for supposed law violations are scams. Such security infections are classed as ransomware. Screen lockers of this nature are created by cyber criminals in the hope that PC users will fall for their trickery and send them the money. There are several ransomware families targeting PC users from different countries using localized variants of their fake messages. In order to make these false messages appear authentic, cyber criminals exploit the names and graphics of local authorities. To determine the location of the target computer, ransomware infections detect IP addresses and are capable of presenting PC users with a deceptive message adapted with graphics and names of local authorities.

In fact, no international authorities use such methods (locking computer screens) to collect fines for any law violations. If your computer desktop is blocked with a message demanding payment of a fine to unblock your machine, your PC is infiltrated with a ransomware infection. Paying these fines is equivalent to sending your money to cyber criminals and there is no guarantee that your PC will be unlocked as a result. The correct way to deal with ransomware infections is to eliminate them from your system. Some of the most widely-distributed ransomware infections exploit the names of the FBI, Internet Crime Complaint Center, Department of Justice, and Police Central E-Crime Unit.

computer locked - ukash virus

Commonly, ransomware infections are proliferated using Trojans, drive-by downloads, and fake video codec downloads. Cyber criminals also create malicious websites capable of exploiting security vulnerabilities within users' PCs, and then infecting these systems with rogue screen lockers. In order to collect bogus fines, cyber criminals use pre-paid card services such as Ukash. Transfering money using this method makes the tracking of cyber criminals problematic for genuine authorities. Note that Ukash is a legitimate service and in no way related to ransomware - cyber criminals simply use this service to extort money from unsuspecting PC users. Commonly, deceptive messages within ransomware infections state that computer users' PCs were locked due to illegal downloads, watching pornography, etc., statements which are false and made only to scare PC users into paying bogus fines. If your computer is infiltrated with a ransomware infection, use the removal guide provided to eliminate this scam from your PC.

Ukash (Smart Voucher Limited) is a legitimate company and not related to ransomware viruses - cyber criminals use this service to extort money from unsuspecting PC users.

Some examples of fake messages presented by the "Computer Locked - Ukash Virus" :

All activity of this computer has been recorded. If you use a web cam videos and pictures were saved for identification. You can be clearly identified by resolving your IP address and the associated host name. Illegally downloaded material (MP3's, Movies or Software) has been located on your computer.

Your computer has been locked!
This operating system is locked due to the violation of the federal laws of the United States of America! (Article 1, Section8, Clause 8, Article 202; Article 210 of the Criminal Code of U.S.A. provides for a deprivation of liberty for four to twelve years.)

Threat of Prosecution Reminder.
You have been violating Copyright and Related Rights Law (Video, Music, Software) and
illegally using or distributing copyrighted content, thus infringing Article 1, Section 8, Clause 8, also known as the Copyright of the Criminal Code of United States of America.

Quick menu:

"Computer Locked - Ukash Virus" removal:

Step 1

Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

alt

Video showing how to start Windows 7 in "Safe Mode with Networking":

Video showing how to start Windows 8 in "Safe Mode with Networking":

Step 2

Log in to the account infected with "Computer Locked - Ukash Virus". Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

remover for "Computer Locked - Ukash Virus"

If you need assistance removing Computer Locked - Ukash Virus, give us a call 24/7:
1-877-484-8393
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. All the products we recommend were carefully tested and approved by our technicians as being one of the most effective solutions for removing this threat.

Cannot boot in Safe Mode with Networking? ("Computer Locked - Ukash virus" blocks Safe Mode with Networking)

If you have more than one user account in your operating system, please log-in to the clean account and download the recommended malware removal software, install it and run a full system scan. Remove all security infections detected. If, however, you have only one user account, please follow this guide (it will describe how to create a new user account using Safe Mode with Command Prompt. Using this newly-created user account you will be able to remove the "Computer Locked - Ukash Virus").

If the "Computer Locked - Ukash Virus" virus also blocks your operating system's Safe Mode with Networking, follow these removal instructions:

1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt Mode loads, enter the following line: net user removevirus /add and press ENTER.

alt

3. Next, enter this line: net localgroup administrators removevirus /add and press ENTER.

creating new user using command prompt

4. Finally, enter this line: shutdown -r and press ENTER.

adding a new user in command prompt

5. Wait for your computer to restart, then boot your PC in Normal Mode and login to the newly-created user account ("removevirus"). This account will not be affected by the ransomware infection and you will be able to download and install recommended malware removal software to eliminate this virus from your computer.

new user account created

6. Download and install recommended malware removal software to eliminate this ransomware infection from your computer:

remover for "Computer Locked - Ukash Virus"

If you need assistance removing Computer Locked - Ukash Virus, give us a call 24/7:
1-877-484-8393
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. All the products we recommend were carefully tested and approved by our technicians as being one of the most effective solutions for removing this threat.

If the newly-created user account is also affected by the ransomware infection, try performing a System Restore:

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt Mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window, click "Next".

restore system files and settings

5. Select one of the available restore points and click "Next" (this will restore your computer system to an earlier time and date, prior to the ransomware infiltrating your PC).

select a restore point

6. In the opened window, click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remnants of Ukash ransomware.

Notice that some ransomware infections are capable of encrypting files stored on an infected PC. If you are dealing with such an infection, you can use some of the tools listed below to decrypt your files.

To regain control of your files (decrypt) try using these tools:

RannohDecryptor (Kaspersky)

XoristDecryptor (Kaspersky)

RectorDecryptor (Kaspersky)

Trojan.Winlock decoding utility (Dr.Web)

Alternative "Computer Locked - Ukash Virus" removal guide:

If this ransomware blocks your screen when you start your computer in Safe Mode with Networking, try starting your PC in Safe Mode with Command Prompt.

1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

win 7 safe mode with command prompt

2. In the opened Command Prompt, type explorer and press Enter. This command will open the Explorer window - do not close it and continue to the next step.

3. In the Command Prompt, type regedit and press Enter. This will open the Registry Editor window.

4. In the Registry Editor window, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

registy editor winlogon

5. In the right side of the window, locate "Shell" and right click on it. Click on Modify. The default value in the Data column is Explorer.exe - if you see something else displayed in this window, remove it and type Explorer.exe (take a note of whatever else was displayed in the Data column - this is the path of the rogue execution file). Use this information to navigate to the rogue executable and remove it.

6. Restart your computer, download and install legitimate anti-spyware software and perform a full system scan to eliminate any remnants of the "Computer Locked - Ukash Virus".

remover for "Computer Locked - Ukash Virus"

If you need assistance removing Computer Locked - Ukash Virus, give us a call 24/7:
1-877-484-8393
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. All the products we recommend were carefully tested and approved by our technicians as being one of the most effective solutions for removing this threat.

Other tools known to remove the "Computer Locked - Ukash Virus":

Comments 

 
#10 Richard Black 2013-04-07 12:35
The best offering to fix this by far.. its taken me days to find this.. all other sites have info missing. many thanks
Quote
 
 
#9 Terry 2013-04-04 07:50
Followed the tips, downloaded and used Spy Hunter 4. Spy Hunter is not free. However, it did get rid of the virus!

Thanks for the useful information!!!
Quote
 
 
#8 bigyin96 2013-03-30 03:40
followed the restore point action as said and its seemed to removed the scam thanks
Quote
 
 
#7 Mark 2013-02-19 00:52
Excellent!

I fixed my laptop with one suggestion you gave. Many thanks!
Quote
 
 
#6 oliver_klozov 2013-02-07 12:21
Awesome fix my friend, thank you for sharing with everyone!
Quote
 
 
#5 admin 2013-01-30 14:02
Hi seangsouly, the message which blocks your computer's screen is a scam. Use the provided removal instructions and eliminate this ransomware from your computer.
Quote
 
 
#4 saengsouly phankam 2013-01-30 13:55
my name is saengsouly phankham,my computer has been block because i have look at porn on the internet.I am not so good with computer ,and i have no idea wat i have done i was just googling ,what ever that i have done wrong i did not mean it iam very sorry.and i have no idea what to do where to go or who to talk to so that i can fix it....
Quote
 
 
#3 Miguel 2013-01-30 02:50
Thank you very much for your help. You made it simple and easy for someone like myself who knows little about computers. Great advice. It fixed my blocked computer in no time!!!
Quote
 
 
#2 Jay 2013-01-18 17:24
Excellent article. Very Useful tips and thank you very much. I fixed mine today
Quote
 
 
#1 seTsd 2013-01-03 10:52
COMBOFIX!!!!!!! !!!!
Quote
 
Add comment
PCrisk.com is not responsible for the content of the comments.


About the author:

I am passionate about computer security and technology. I have an experience of 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an editor for pcrisk.com since 2010.

Follow me on Google+ to stay informed about the latest online security threats.

Our malware removal guides are free. However, if you want to support us you can send us a donation.