Solved Ukash strikes again

Discussion in 'Virus, Spyware and Malware Removal' started by poisonmushroom, Aug 13, 2012.


Thread Status:
Not open for further replies.
  1. poisonmushroom Bronze Member

    Bronze
    Message Count:
    4
    Likes Received:
    0
    My System
    Loading...
    Hi guys,
    I have the West Yorkshire police variant of the Ukash ransomware. It looks a little different to other West Yorkshire police variants that I've seen though. I'm currently running everything in Safe Mode with Networking and I've got another laptop running just in case this computer goes completely nuts though.
    I've email subscribed to the thread, gotten rid of any peer-to-peer stuff and hopefully done all the necessary prework stuff.
    Thanks for any help you can give me.

    Attached Files:

  2. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    592
    My System
    Loading...
    Please download Malwarebytes Anti-Malware from Malwarebytes.org
    Alternate link: Download Mirror

    (Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

    Double Click mbam-setup.exe to install the application.

    (Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)
    Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
    If an update is found, it will download and install the latest version.
    Once the program has loaded, select "Perform Full Scan", then click Scan.
    The scan may take some time to finish,so please be patient.
    When the scan is complete, click OK, then Show Results to view the results.
    Make sure that everything is checked, and click Remove Selected.
    When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If you are prompted to restart, please allow it to restart your computer. Failure to do this, will cause the infection to still be active on the computer.
    Please save the log to a location you will remember.
    The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    The log can also be found at C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Copy and paste the entire report in your next reply.
    If Malwarebytes fails to download please use the following link:

    http://malwarebytes.org/mbam-download-exe-random.php

    =============================================

    Download Combofix from any of the links below, and save it to your desktop.
    Link 1
    Link 2
    When saving ComboFix rename it to PCHelpForum.exe to prevent it from being blocked by malware.

    Refer to this image:
    To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.
    • Close any open windows and double click PCHelpForum.exe to run it.
      You will see the following image:
    [IMG]

    Click I Agree to start the program.
    ComboFix will then extract the necessary files and you will see this:

    [IMG]

    As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7
    It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    If you did not have it installed, you will see the prompt below. Choose YES.

    [IMG]

    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [IMG]

    Click on Yes, to continue scanning for malware.
    When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
    Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.
    Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
    poisonmushroom likes this.
  3. poisonmushroom Bronze Member

    Bronze
    Message Count:
    4
    Likes Received:
    0
    My System
    Loading...
    I can get into windows normally now. Thanks. I've had to attach the Malwarebytes log, as it's apparantly too long to post in a message.

    Attached Files:

  4. Google Advertisement

  5. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    592
    My System
    Loading...
    Ok.Thats looking a lot better.I would just like to finish off with these last two checks...

    I would just like to check for any additional security risks:

    Please download CKScanner and save to your desktop.
    Double-click on
    CKScanner.exe and click Search For Files.
    After a very short time the cursor hourglass will disappears.Please click Save List To File. Click OK.
    Post the contents of ckfiles.txt in your next reply. It will be found on your desktop.

    ===================================




    I'd like you to scan your machine with ESET OnlineScan


    • Scan your system with Online Scanner
    • Place a check mark in the box YES, I accept the Terms Of Use.
    • Click the [IMG] button.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
    • Click on [IMG] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [IMG] icon on your desktop.
    • Check [IMG]
    • Click the [IMG] button.
    • Accept any security warnings from your browser.
    • Check [IMG]
    • Make sure that the option to "Remove Found Threats" is UN checked.
    • Push the "Start" button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push [IMG]
    • Push [IMG], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Push the [IMG] button.
    • Push [IMG]
    poisonmushroom likes this.
  6. poisonmushroom Bronze Member

    Bronze
    Message Count:
    4
    Likes Received:
    0
    My System
    Loading...
    CKScanner - Additional Security Risks - These are not necessarily bad
    c:\documents and settings\user\my documents\my music\itunes\itunes music\unknown artist\burton manor apr 2006\16 crack of dawn.m4a
    c:\documents and settings\user\my documents\my music\itunes\itunes music\unknown artist\unknown album\09 crack of dawn.m4a
    c:\program files\mount&blade\sounds\fire_small_crackle_slick_op.ogg
    scanner sequence 3.AB.11.PFCPEX
    ----- EOF -----

    Attached Files:

  7. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    592
    My System
    Loading...
    Ok.I suggest you remove your restore points.Instructions here Also remove Bear Share and the Babylon tool bar.

    Ok.All done.I see no more malware.Log looks good! All that was detected is now either in quarantine or system restore, both of which we'll be cleaning out in just a minute. Congratulations, well done.

    You can now uninstall ComboFix

    • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
    • In the field, type in ComboFix /uninstall
    [IMG]

    (Note: Make sure there's a space between the word ComboFix and the forward-slash.)

    • Then, press Enter, or click OK.
    • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.

    Over the course of the fix you've used a variety of special tools to help with the cleaning process - none of these are of any use to you now that you're clean, and it's best not to have them hanging around on your computer. OTC is a small program that removes all the leftover tools and logs from cleanup of malware.

    Please download OTC to your desktop.

    Double-click OTC to run it. (Vista users, please right click on OTC and select "Run as an Administrator")
    Click on the CleanUp! button and follow the prompts.
    You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
    After the reboot all the tools we used should be gone.
    Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

    Here are some tips to reduce the potential for malware infection in the future; I strongly suggest that you read them and take them to heart so that you don't have to endure the process of cleaning your computer again.
    Afterwork
    Malware Prevention
    How Did I Get Infected
    More Tips on Prevention

    =============================
    poisonmushroom likes this.
  8. poisonmushroom Bronze Member

    Bronze
    Message Count:
    4
    Likes Received:
    0
    My System
    Loading...
    Hi thank you very much. I have a couple of questions. Is the computer now safe to use for online banking and all that sort of thing, or will there always be a risk in doing so? Also Bearshare and Babylon are horribly annoying and won't uninstall normally. Is there a force uninstaller that you'd recommend for doing that job?

    Thanks for all your help. I will give you a donation ASAP.
  9. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    592
    My System
    Loading...
    Revo Uninstaller should remove that stuff,and yes,you can do your banking safely now.

Ukash strikes again

Thread Status:
Not open for further replies.