POLICE RANSOM TROJANS | GreenDot MoneyPak, Ukash, Paysafecard

**highwayman274** · October 7th, 2015, 06:50 PM

Over the past 2 or 3 years I have noticed posts in the Problems With Image Hosts thread regarding viruses being downloaded from trusted sites. It seems to be a recurring theme, and confirms that some of these bugs can penetrate despite the use of Firewalls, Anti-virus Security software, and Ad-Blockers.

Getting rid of these viruses can be a challenge, and in my opinion the worst of the bunch is the unadulterated version of the Police Ukash trojan.

My first encounter in 2012 was perhaps the biggest scare of my adult life (yeah ... I know ... I’ve got to get a life). But after my heart rate returned to normal and my hair stopped standing on end, I used another computer to Google a solution to the screen-locking, siren sounding, camera activating monster that had infected my laptop.

That introduced me to MalwareBytes, and saved the day.

Here is an excerpt from the MalwareTips web-site, and a link to the removal instructions. One of the options is to use the free download offered by MalwareBytes at their secure site; there is no need to purchase anything to obtain help. That web-link is also attached, below.

“ If your computer is locked, and you are seeing a “Your computer has been blocked” notification from a law enforcement agency (FBI, Australian Federal Police, Metropolitan Police, U.S. Department of Justice) asking you to pay a fine via GreenDot MoneyPak, Ukash or Paysafecard code, then your computer is likely infected with a piece of malware.

The Police Ukash or Moneypak virus is distributed through several means.

Malicious websites, or legitimate websites that have been hacked, can infect your machine through exploit kits that use vulnerabilities on your computer to install this trojan without your permission or knowledge.

Another method used to propagate this type of malware is spam email containing infected attachments or links to malicious websites.

Cybercriminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link embedded inside the email). And with that, your computer is infected with the Police Ukash or Moneypak virus.

The threat may also be downloaded manually by tricking the user into thinking they are installing a useful piece of software, for instance a bogus update for Adobe Flash Player or another piece of software.

The Police Ukash or Moneypak virus is also prevalent on peer-to-peer file sharing websites and is often packaged with pirated or illegally acquired software.

Once installed on your computer, the Police Ukash or Moneypak virus will display a bogus notification that pretends to be from an official law enforcement agency (examples: Irish An Garda Síochána, Royal Canadian Mounted Police, Police Central e-crime Unit) and states that your computer has been blocked due to it being involved with the distribution of pornographic material, SPAM and copyrighted content.

The Police Ukash or Moneypak virus will lock you out of your computer and applications, so whenever you try to log on into your Windows operating system or Safe Mode with Networking, it will display instead a lock screen asking you to pay a non-existing fine in the form of a Moneypak, Ukash or Paysafecard voucher. Furthermore, to make this alert seem more authentic, this virus also has the ability to access your installed webcam, so that the bogus Police Ukash or Moneypak notification shows what is happening in the room.

The Police Ukash or Moneypak lock screen is a scam, and you should ignore any alerts that this malicious software might generate. Under no circumstance should you send any Greendot Moneypak, Paysafecard or Ukash code to these cyber criminals.”

MALWARE-TIPS - 3 WAYS TO REMOVE ANY POLICE RANSOM TROJAN

http://www.anonym.to/http://malwaret...police-trojan/

MALWAREBYTES - FREE DOWNLOAD SITE

http://www.anonym.to/https://www.malwarebytes.org/

**pharoahegypt** · October 7th, 2015, 09:39 PM

Have we not already discussed this ***** virus at length...?

Although all the advise posted above is worth mentioning on a regular basis.... Sadly, if you get a certain genre of the 'police/*****' virus you won't even be able to access your computer to fix it. Only option then is to use a boot disc to reinstall you OS.

If you want to keep files/data then be careful not to delete the partition that contains the original OS when doing so, as you can transfer all the data over ,,, once you've installed Malwarebytes and a good Virus protection first ... don't do it first or you'll quickly be up the creek again in days.

Make sure to then delete the original OS from the 'windows.old' folder too.

**Moon Raker** · October 8th, 2015, 09:04 AM

Quote:

Originally Posted by highwayman274

That introduced me to MalwareBytes, and saved the day.

Yes indeed MWB is probably the best of its genre and the basic version (batch scans only) is free though after trying it many will update to the paid version MWB PRO which also gives real-time protection - as I did. It even offers a 'deep scan' option to weed out rootkits though that does take an age to run. You may of course need to boot up in Safe Mode (F8) in some cases though MWB does also contain a 'Chameleon' option to help out in such circumstances. You can also update to a free version of MWB Anti-Exploit which protects the browser and add-ons for zero-day threats, again that can be updated at cost to provide even more comprehensive protection though I have never felt the need for that. I have also tried the free trial version of Hitman Pro which was effective at weeding out cookies still left after MWB and MS Essentials scans but I was not tempted to upgrade to the paid version. I write this as a satisfied customer only, I have no other connection to MWB.

**pferdewurst** · October 8th, 2015, 10:38 AM

Quote:

Originally Posted by pharoahegypt

Have we not already discussed this ***** virus at length...?

Yeah it´s getting boring. Also this avast found some viruses.

October 7th, 2015, 06:50 PM	#1
highwayman274 Former Staff Join Date: Nov 2008 Location: The Great White North Posts: 7,697 Thanks: 245,126 Thanked 130,613 Times in 8,119 Posts	POLICE RANSOM TROJANS \| GreenDot MoneyPak, Ukash, Paysafecard Over the past 2 or 3 years I have noticed posts in the Problems With Image Hosts thread regarding viruses being downloaded from trusted sites. It seems to be a recurring theme, and confirms that some of these bugs can penetrate despite the use of Firewalls, Anti-virus Security software, and Ad-Blockers. Getting rid of these viruses can be a challenge, and in my opinion the worst of the bunch is the unadulterated version of the Police Ukash trojan. My first encounter in 2012 was perhaps the biggest scare of my adult life (yeah ... I know ... I’ve got to get a life). But after my heart rate returned to normal and my hair stopped standing on end, I used another computer to Google a solution to the screen-locking, siren sounding, camera activating monster that had infected my laptop. That introduced me to MalwareBytes, and saved the day. Here is an excerpt from the MalwareTips web-site, and a link to the removal instructions. One of the options is to use the free download offered by MalwareBytes at their secure site; there is no need to purchase anything to obtain help. That web-link is also attached, below. “ If your computer is locked, and you are seeing a “Your computer has been blocked” notification from a law enforcement agency (FBI, Australian Federal Police, Metropolitan Police, U.S. Department of Justice) asking you to pay a fine via GreenDot MoneyPak, Ukash or Paysafecard code, then your computer is likely infected with a piece of malware. The Police Ukash or Moneypak virus is distributed through several means. Malicious websites, or legitimate websites that have been hacked, can infect your machine through exploit kits that use vulnerabilities on your computer to install this trojan without your permission or knowledge. Another method used to propagate this type of malware is spam email containing infected attachments or links to malicious websites. Cybercriminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link embedded inside the email). And with that, your computer is infected with the Police Ukash or Moneypak virus. The threat may also be downloaded manually by tricking the user into thinking they are installing a useful piece of software, for instance a bogus update for Adobe Flash Player or another piece of software. The Police Ukash or Moneypak virus is also prevalent on peer-to-peer file sharing websites and is often packaged with pirated or illegally acquired software. Once installed on your computer, the Police Ukash or Moneypak virus will display a bogus notification that pretends to be from an official law enforcement agency (examples: Irish An Garda Síochána, Royal Canadian Mounted Police, Police Central e-crime Unit) and states that your computer has been blocked due to it being involved with the distribution of pornographic material, SPAM and copyrighted content. The Police Ukash or Moneypak virus will lock you out of your computer and applications, so whenever you try to log on into your Windows operating system or Safe Mode with Networking, it will display instead a lock screen asking you to pay a non-existing fine in the form of a Moneypak, Ukash or Paysafecard voucher. Furthermore, to make this alert seem more authentic, this virus also has the ability to access your installed webcam, so that the bogus Police Ukash or Moneypak notification shows what is happening in the room. The Police Ukash or Moneypak lock screen is a scam, and you should ignore any alerts that this malicious software might generate. Under no circumstance should you send any Greendot Moneypak, Paysafecard or Ukash code to these cyber criminals.” *MALWARE-TIPS* - 3 WAYS TO REMOVE ANY POLICE RANSOM TROJAN http://www.anonym.to/http://malwaret...police-trojan/ *MALWAREBYTES* - FREE DOWNLOAD SITE http://www.anonym.to/https://www.malwarebytes.org/ Last edited by highwayman274; October 8th, 2015 at 03:10 PM.. Reason: Adding second web-link

October 7th, 2015, 09:39 PM	#2
pharoahegypt Vintage Member Join Date: Dec 2007 Location: Middle England Posts: 4,491 Thanks: 10,176 Thanked 43,617 Times in 4,154 Posts	Have we not already discussed this *** virus at length...? Although all the advise posted above is worth mentioning on a regular basis.... Sadly, if you get a certain genre of the 'police/*' virus you won't even be able to access your computer to fix it. Only option then is to use a boot disc to reinstall you OS. If you want to keep files/data then be careful not to delete the partition that contains the original OS when doing so, as you can transfer all the data over ,,, once you've installed Malwarebytes and a good Virus protection first ... don't do it first or you'll quickly be up the creek again in days. Make sure to then delete the original OS from the 'windows.old' folder too. __________________ Arguing with a intelligent person is hard; but arguing with a stupid person is impossible!**

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode