Ukash Ransomware Malware Problem

I seem to have contracted this malware virus which presents a screen stating the Cyber Crime is investigating me for copyright violation and illegal file downloads and that I must pay $100 to unfreeze my PC.

I ran a BD Syslog which can be found here;

http://www.sendspace.com/file/p8izxt

Find more posts tagged with

Comments

rootkit

Hello

Please pack these files

C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

in archive with the password infected and upload it on

http://www.sendspace.com

http://www.mediafire.com

and send me a PM with the download link.

We will analyze the information you sent and then reply with a possible solution in the shortest time.

Have a nice day.

shanejohnston@rogers.com

Hi Christian, I sent you a pm about this but not sure that it got through to you or not since I don't see it in my sent messages box.

I have uploaded the files you asked for to Sendspace now.

Can you please let me know if you recieved my pm with the link?

rootkit

Hello

I have received the files, but my colleagues from the labs need these ones too:

C:\ProgramData\lsass.exe

C:\Users\Shane\AppData\Local\Temp\wgsdgsdgdsgsd.exe

Please send me the files in the same way. After that, you can delete them from your PC.

Thank you!

shanejohnston@rogers.com

Thanks for your help Christian.

I just uploaded the other 2 files for you and sent you a pm with the link.

thx ...Shane

rootkit

Hello

Currently the file is detected as Trojan.Generic.8187164.

Thank you for the sample.

Have a great day!

shanejohnston@rogers.com

Thanks Christian, but how do I get rid of it?

I have already scanned using Bitdefender 2012 several times.

thank-you ...Shane

terminology

Thanks Christian, but how do I get rid of it?

I have already scanned using Bitdefender 2012 several times.

thank-you ...Shane

Hey Shane,

You might be best locating all of the files using a Linux Live CD such as the bitdefender one and remove the virus manually it will probably be best to find out more about the specific ransomware you have because they may have encrypted other files, failing this will probably just result in a complete wipe to be honest...

rootkit

Hi Shane

Now, since all the files are detected, you can manually delete them from Safe Mode.

C:\ProgramData\lsass.exe

C:\Users\Shane\AppData\Local\Temp\wgsdgsdgdsgsd.exe

C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

http://www.bitdefender.com/support/How-do-...-Mode-1022.html

After this, reboot in Normal Mode and run a Full System Scan with Bitdefender.

Take care.

shanejohnston@rogers.com

Thanks Christian ...I have done that and it seems to be fine now.

thanks a ton for your support!

...Shane

rootkit

Hi Shane

You are most welcome!

Let me know if you have other questions related to malware or our products.

Have a great weekend!

Liebens_j@telenet.be

I had this problem today. <img class= " />

1st problem: Bitdefender didn't detected it, while it manifested onto the pc???

2nd problem: In Safe mode, aparently it is not possible to start bitdefender to do a scan???

3d problem: If you do a online scan with bitdefender it says you dont have any problem???

So I ask myself the question what can bitdefender to for me???

So I had to install in safe mode another scanprogram to get rid off this virus/trojan.

I think it is very strange that a free tool, can find the infected files and my own virusscanner where I pay for doesn't. :unsure:

Apperently when its time to renew my licence, bitdefender already made the choice for me. :mellow:

rootkit

Hello

Please follow the steps from here to remove this type of infection:

http://forum.bitdefender.com/index.php?showtopic=42261

Should you need any further assistance, please do not hesitate to contact us.

Have a great day!