How to Remove Ransomware Ukash Virus

Ukash Virus is an aggressive ransomware scam that tries to steal money from you. The infection displays bogus messages of various official institutions, mostly local police. Ukash Virus locks your PC completely, therefore you will be not able to perform any task on your computer. To unlock PC, the message advises to pay the fine. However it is only a scam and paying the fine will not unlock your PC.

Ukash Virus PCEU

Ukash Virus ransomware is named Ukash Virus under the payment platform which the virus requires. The fines are paid by using a pre-paid system. Remember, that none of official institutions would request to make payments via systems like Ukash. Therefore it is a strong evidence that this is not a real warning and none other than a scam.

In different countries Ukash Virus uses different names of official institutions related to local region. If computer has an IP address of United Kingdom, the fake message will be presented as Metropolitan Police ‘official’ statement. Meanwhile in Germany you may be threatened by displaying Bundespolizei name and logo, so as Politie Federal Computer Crime Unit in Netherlands or Federal Police in Australia.

Reveton CA

Ukash Virus uses a legitimate trading name of company Smart Voucher Limited, but it is no way related to the infection. Therefore, DO NOT pay any fines.

Please follow our removal guide and remove Ukash Virus in a few steps. You can also follow our video guide: How to remove Ukash Virus

Tech SupportTech Support to Remove Ransomware Ukash Virus

Call toll-free number for malware removal assistance. 24/7 USA based Tech Support

USA and Canada: 1-877-636-2848
UK: 448000488705
Australia: 1300-301-682

Ukash Virus Removal Guide

1. Restart your computer and press F8 while it is restarting
2. Choose ‘Safe Mode with Networking

Step 1. In order to detect and remove Ukash Virus, download SpyHunter anti-spyware software


Windows XP/Vista/7/8, Internet Explorer 6.0 or later

Read more about SpyHunter EULA

Step 2. Click Run or Open and install the application by following the on-screen instructions (How to Install)

Step 3. SpyHunter will automatically scan and detect threats

Step 4. After scanning, click Fix Threats button

Learn more about SpyHunter

Note: download size is 0.7 MB. Trial version offers an unlimited number of scans and detections for free. You can remove detected files, processes and registry entries yourself or purchase a full version for 39.99 USD.

Alternate Removal Method

1. Restart your computer and press F8 while it is restarting. Then choose ‘Safe Mode with Command Prompt

Safe Mode with Command Prompt

2. In the opened command prompt type explorer and press Enter. This command will open explorer window, don’t close it and continue to the next step.

3. In the command prompt type regedit and press Enter. This will open the Registry Editor window.

4. In the Registry Editor window navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\


5. In the right side of the window locate “Shell” and right click on it. Click on Modify. The default value data is Explorer.exe If you see something else written in this window, remove it and type in Explorer.exe

6. Restart your computer.

Step 1. In order to detect and remove Ukash Virus, download SpyHunter anti-spyware software


Windows XP/Vista/7/8, Internet Explorer 6.0 or later

Read more about SpyHunter EULA

Step 2. Click Run or Open and install the application by following the on-screen instructions (How to Install)

Step 3. SpyHunter will automatically scan and detect threats

Step 4. After scanning, click Fix Threats button

Learn more about SpyHunter

Note: download size is 0.7 MB. Trial version offers an unlimited number of scans and detections for free. You can remove detected files, processes and registry entries yourself or purchase a full version for 39.99 USD.

What are the symptoms of Ukash Virus?

  • Displays a bogus alert of assumed illegal actions
  • Prevents programs from running
  • Blocks internet access
  • Hides system files and folders
  • Displays aggressive fake alerts and fake scan alert

Manual Ukash Virus removal

Important Note: Ukash Virus can be removed manually, however any mistakes can lead your PC to permanent damage of the system. Therefore a manual removal process is highly recommended for IT experts and system administrators. For regular users, team recommends using SpyHunter or any other reputable security application.

Stop Ukash Virus processes:

Remove these Ukash Virus files:


  1. Ross Satterthwaite

    Hello, I’ve got myself this Ukash virus & have followed the instructions several times using the different techniques but without luck. As soon as I try typing it all just stops. The mouse won’t move and can’t type. Eventually the screen saver kicks in & that’s it. I’m using Windows XP Professional.

    Any ideas?

    1. David bridgwood

      Im using inspiron 620 desktop I have had the PCEU virus come up I have tried all the removal advice when i press the F8 key the and click on safe mode with networking i press enter then my it goes to where i can log in when i put my password in a black flashes on then off then then the computer restarts it self then when i log in the PCEU msg comes up again i even tried the task manager one aswell it just flickers on then off again with the PCEU msg staying on i even tried the other F8 one safe mode command prompt and the same happens again

  2. ann

    I have a problem to remove this virus. My computer is totally block. As soon as I sing in the screen is just blank. I tried to download the virus program on a diffrent computer but have a difficulty to safe it on a memory stick. Can someone please help me

  3. laith

    Hi, i use f8 and select the option to boot in safe mode with both networking and command prompt but when i press return my pc goes to the next screen then selects XP but then returns to the original boot up to normal mode! so i cannot run the removal tool….help please!

    1. admin

      1. Restart PC to Safe Mode with Networking
      2. Open Start menu and click on RUN
      3. Type ‘msconfig’ and press Enter
      4. System Configuration menu will appear. Click the Startup tab and un-check all programs you see. Click OK and exit the menu
      5. Restart your computer in Normal Mode and scan again your PC with SpyHunter

  4. Hendrik-Jan

    Hi there,

    Today, i had exactly the same problem. Starting in Safe mode, looking in the key’s as specified above, or in HKCU / HKLM / Software/Microsoft/Windows/CurrentVersion/Run and Software/Microsoft/Windows/CurrentVersion/RunOnce doesn’t show exiting values.

    I figure’d out that there was another trick. With Regedit you can load a hive from a specific reg file (Works only under HKEY_LOCAL_MACHINE and HKEY_USERS).
    1. Start Regedit.
    2. Select the root key HKEY_USERS
    3. Select in the Menu: File -> Load Hive
    4. In the popup-box select the NTUSER.DAT file in the user directory:
    (In Vista it’s located in C:\Users\%username%\NTUSER.DAT
    5. After opening the file a key name is asked, enter a name (it doesn’t matter what, for e.g. “USERNAME”.
    6. Now in the regestry, under HKEY_USERS\ the regfile is loaded.
    7. Beneath this key, there was also a key Software/Microsoft/Windows/CurrentVersion/Run
    and that holds a string value with name WSManHTTPConfig and value something like:

    Locate the dir with explorer and remove the files. (For me it where two files “WSManHttpConfig.exe” and another named “701fb4e0″).

    Remove the reference from the registry key located at point 7.
    After you have done this, you must unload the hive. Collapse the key and go to “HKEY_USERS”. Select the key with the name you entered at point 5 (“USERNAME”)
    and go to File -> Unload Hive.

    Now restart the computer. If it was the same as me, the virus is removed.

  5. ian pullin

    We seem to have got this met police virus this week from our daughter downloading music/movies.
    I have tried the various methods above to remove but unfortunately they have not worked.
    When going into safe mode/safe mode with networking or safe mode with command prompt it starts to scroll through lines of text then stops and reboots, not allowing any further progess.
    It is on xp home with Kapersky security.
    It lets us get as far as the log in page and then after clicking on the user (either ours or our daughters) within around five seconds of seeing the desktop the warning page pops up with no time to run anything – I have tried!
    Any ideas on a way forward?

  6. Hassan

    I have the ukash virus. I can only start my laptop with command prompt as other options shuts down and reboots automatcally.

    I tried to follow all of the suggestions but nothing worked. Help please



  7. Hassan

    No, I do not have another account on my computer.

    I have downloaded kaspersky .iso with imgburn and booted from it successfully. However, it did not see my HD

    I have also removed my HD and connected it via USB kit to another computer. It also did not see it

    Any other ideas please.


  8. brian

    To get back control of your computer the first thing to do is once ukcash has started shut down your machine. Restart but in safe mode without network. In safe mode go to restore to previous point. Restore you an ealier date. You then re-boot and you will then have control. The ukcash will stop operating. Use one of the many spy ware / malware search saoftware to locate it and remove. Also use a registery cleaning software and this should resolve the problem.

  9. Anonymous

    I got this after clicking on a link to download a mod for a game, i literally panicked and started shaking and luckily i logged onto my PC (the virus is on my laptop) and found out it was only a virus, when i go on safe mode, safe mode with networking, and safe mode with command prompt, the computer just restarts and goes back to the menu, the only option which will start is start windows normally but obviously this doesn’t help. Please, please help me, i am panicking here, im only a kid so im obviously scared as all i was doing was installing a mod for a game, thank you.

  10. anonymous

    I have tried all the above but it hasnt worked.I managed to switch user and ive been able to get my work done.
    Now the previous user account infected withvirus has an option of deleting it after saving all my files onto myother user account and do a system scan to get rid of the virus but am not quite sure if this will work.
    Someone please advise

  11. Matt

    I have tried to start windows in all modes the only one that works is safe mode command promt,I followed instructions and found that explorer exe was already typed in the shell option so know I have no other way to get rid of this virus

  12. james

    I was downloading a music video then all of a sudden I got a metropolitan police massage saying they have detected illegal activity and I have to pay 100 pounds too release my computer with in 24hrs. I panicked and paid the money by ukash, but I paid by credit card. Can I claim the money back from my credit card company as I was scammed?. Am I covered? Please help.


    1. admin


      definitely contact your credit card company and ask to reject a transaction. Metropolitan Police message is a scam and should be removed from your PC as soon as possible. Please let us know if you need any help.

  13. Anthony

    I’ve tried to connect with safe mode/safemode network and it doesn’t work because I get that virus again on my screen.
    So I tried to follow what you did with Safe mode with command prompts and in the cmd.exe I can’t do the explorer or I get that virus on my screen again so I tried it again but this time I directly used regedit and followed every step and next to shell I found explorer.exe so there were no any defaults on that. And this nasty virus is still on my computer. please help.

    Sorry for my last message, I sended it uncomplete unknowingly.

  14. PKalltheway

    I cannot seem to be uble to access my laptop at all even with safe mode(with and without networking) adter I have logged in even before the destop even lpafs up it automatically shuts down, it will then turn itself on in normal mode where the virus is

  15. ronaldo

    hello. I tried to do on my windows XP, but when I go to safty mode with network, there is something else popping up.
    I have to choises:
    “Microsoft windows XP home editioen” or
    “Micorosoft windows XP recoverycontrol”
    Don’t know what to do!

  16. Oneil

    I have tried removing the virus using safe modes. Both safe mode with networking and with command prompt. However the computer logs out and back in to where the ukash virus is located. Is there anything else I can do?

  17. Linda Riley

    This wretched Ukash virus. I know I need to get into the computer to restore to a safe point however when I start in safe mode with networking it goes through the motions of starting normally but the desktop only appears for a second and then a grey screen. I have tried starting safe mode with command prompt but I dont even get the couple of seconds I need to to type in “explorer” to at least try to get me to restoring to a previous safe point – instead it says it is loading files and I see them sailing up the screen and then it stops….nothing – just words of files. I have downloaded a couple of removal tools to use but I dont know how to get the laptop to boot from the CD. It seems I am computer challenged at this point. Any other ideas?

      1. Mark McKenzie

        Given the polices’ ability to trace our social networking sites, and have superior technology, why are they allowing this criminal activity to continue? Also is there any guarantee that after taking a pc/laptop to a pc repair shop, that you won’t be back there a few days later with the same problem?

  18. alice

    Hi, tried all of the above methods, safe mode, safe mode with networking, with control prompt, and nothing works. Can’t reset to previous time as can’t access control.panel to do this. I Have tried all the advice in this page in fact. Looks as if p c shop might be my only hope.. Thanks to all those who have posted what worked for them tho.

  19. elliot

    I’ve got the same problem and I’ve tried everything you’ve said but every time it just logs me out puts me back into normal mode and opens the stupid thing up again pleaseeeeeee help

  20. steve

    I’ve had this virus on my laptop too, and was able to regain control by rebooting in safe mode, and reinstalling the system from earlier date as is described here in earlier messages. I ran after that a full system scan with Norton. Funny enough, two days later I had the same problem, and I discovered that this virus had first disactivated the “Antivirus” “Antispyware” and the “e-mail protection” in my Norton, and deleted the virus definitions and then attacked. I went to the same process, reinstalled the virus definitions, ran a full system scan, and had a save system again….. I tested the system by doing the same thing as before, and I had it again… Does this mean that this virus is installed somewhere in my laptop, and Norton can not find it, or does it mean that is has become that clever to first eliminate the protection software before it attacks….This would be a bit scary….

  21. Pete

    This virus is clearly evolving and I would not be surprised if the scammers were not browsing the AV forums to then block the published fixes. Safe Mode (in any form) will not work for me. A DOS script runs immediately the command prompt appears and immediately launches Windows in normal mode which then runs the lockout screen. If any attempt is made to launch Safe Mode without the command prompt, the virus has enough control to put the computer into shutdown.

    I have tried booting from a recovery CD with no success.

    The virus got past Microsoft Security Essentials without even causing an alert and from comments above does seem to attack AV and anti-malware programmes before installing itself.

    The AV labs do not seem to have a conclusive fix as most sites direct to Safe Mode with Networking, when this will in most cases no longer work. This is very worrying and puts the whole AV industry’s credibility in question. Unless these scammers are caught quickly and stopped permanently from repeating or sharing their warped knowledge, this seems a serious global risk.

    This is frankly now looking more like cyber-terrorism and it would be good if the authorities were doing something tangible to resolve the problem.

  22. Mr J Manuel

    I have just been hit by this virus tonight, was watching some old 90s music videos on You Tube when a warning appeared and my webcam flashed. The Metropoltian Police E-crime Unit page came up with a photo of me taken by webcam asking me to pay £100 by Ukash. I had heard of this virus last year when it happened to a work colleague (He simply bought a new laptop and broke up his old one as the repair cost would have been more than the laptop which was old) Looking on my Kindle to access how to remove it, I restarted whilst pressing the F8 and selecting the repair option rather than the one of the Safe options. This basically recovered my laptop to the original factory settings. I have bought and downloaded Norton anti virus as recovery removed the old subscription. The laptop seems to be running fine and a full system scan is clean but any experts able to tell me if the action I have taken is enough to rid my machine of this blasted virus?

  23. Euan

    I have the virus on my computer and everytime I reboot my machine in safe mode with networking it keeps restarting and going to ommand propmt but wont let me do anything else I just keeps going onto the virus straight away.
    Has anyone any ideas

  24. carys

    I have this virus and the first time it come up to my laptop for 2 weeks I thought I should take it to the police but my friend said I should get other one but I don’t know cuz ever time I try and do somethink to my laptop it just keeps coming like police one and I thought it was real I still do when it comes up I have try about 8 other ones to keep the virus off my laptop and it just did work and I just want it of my laptop cuz mine said that I have to pay about £100 I was just thinking about paying it but every video said that it is fake I really don’t know tell I go to shop and they will that it is fake or virus it was a bit scary cuz when I talk to this guy who he said that he can get it if I said to him do u know ever shops in Manchester to get the virus off he said no and I think I will just try and get it off myself I gonna see if it works if it does work I will go to the police or I will try and get it off but I hate it being on my laptop and I just wanna get it off cuz I done nothing Wong and this is the first ever time its being on my laptop…..

  25. Margaret

    I’m unable to scroll up to Safe mode to Networking using keyboard, Highlighted is Start Windows Normally
    keyboard seems only to start working when Windows starts loading,

    Many Thanks

  26. Joolz Busts It!

    Okay, if this can help other people infected with this crud: a friend turned up last night and explained that the computer was locked with the Ukash/PCeU scam and he had no control over his computer. Firstly the virus was refusing to let the computer shut down so it would only go into hibernate (by hitting the power button), so when Windows came out of that mode it wasn’t booting and the virus was still in control. The log on screen appeared with a “Username Locked” button and a “Change User” option, clicked on “Change User” and got to a log on screen with the proper username, clicking on that just brought back the scam page (i.e. the virus is continually loaded into the memory would be my guess) so you have to find a way to force a restart so you can hit F8.

    So back to the “locked” log on screen, “change user”, okay now look for the little red power off button in the bottom right hand corner and click on the arrow next to it, choose “restart the computer”. At reboot hit F8 several times until you get the advanced startup options screen – with this latest version it appears to be a waste of time trying “safe mode” – I tried and Windows booted up in safe mode and once fully loaded, immediately shut down, rebooted and we were back to square one.

    So forget safe mode and choose “system repair” instead, then choose the “system restore” option, choose a date/restore point before your computer got locked, and tell Windows to restore to this point, cross your fingers, hit go and … be patient. It took a good 20-30 minutes to restore Windows and then the computer rebooted and, as if by magic, we were back into Windows, no scam messages, nothing.

    Obviously, afterwards, do some or all of the following, download/run CCleaner, clear out the cache and temp files, check the uninstallation list and get rid of any unwanted crap like toolbars and so on, do a reg sweep and fix all reg issues (backup the file just in case). Install/run/update Spyware Blaster. Update your AV software and run a FULL scan. On friend’s computer it took 1h45 with Microsoft Security Essentials but it found 1 trojan and one Java exploit, obviously fix/remove, then check that you have the latest versions of your browser (FF or IE or Chrome), latest version of Java, Flash, Adobe Reader and so on (all the web-based stuff). Check each piece of software and turn on automatic updating/notifications as hackers/scammers exploit any security issues as soon as they’re discovered, if you’re running an outdated Firefox or Adobe Reader for example, you are giving the scammers a way in to your computer.

    Hope this helps!

  27. barrister

    I’m sorry for all your problems and this is hindsight but BACK-UP your computer regularly and have a rescue disk. Then you won’t have these terrible problems. System restore is NOT a reliable back-up. Good luck to all but God helps those who help themselves!

  28. Lucy

    Hi. Today my mac was shut down by the ukash virus, I’m not really sure what to do and whether to try the manual reboot or not in case it damages my laptop further or whether to wait and see a professional to get rid of the virus? Also, does the manual shut down to so get rid of the virus work the same on a mac? Thank you for your help

Leave a Reply to Matt Cancel reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>