Police Central e-Crime Unit (PCeU) Ukash/Paysafecard Virus: Ransomware Analysis and Removal

Following the influx of the FBI MoneyPak ransomware variants, yet another type of extortion technique came to be in June 2012, pretending to emanate from the Police Central e-Crime Unit, part of the British Metropolitan Police Service. Mainly targeting UK users through determining the victim’s IP location, the virus displays a fake Windows block screen on behalf of the above-mentioned law enforcement agency and lists possible cybercrime offenses that the user is allegedly guilty of. To settle down the ‘case’, the ransomware suggests that the victim pays a fine of 100 Euro for the completely hijacked computer to be unlocked. The extorted payment is to be submitted via Ukash or Paysafecard prepaid services by entering a corresponding code from a purchased card into the block page.

The prevalent known channel that the fraudsters have been utilizing for distributing the Police Central e-Crime Unit ransomware has to do with web exploit toolkits, such as BlackHole, as well as the infection known as Trend DNSChanger Bot, offspring of the infamous DNSChanger whose infrastructure was taken down by the FBI in 2011 and resulted in a number of arrests. The way victims get infected is typically through exploiting software vulnerabilities, mainly those in Java – yet another good reason for the average user to run regular Java updates.

PCeU Ukash virus: versions and screenshots

There are two known variants of the Police Central e-Crime Unit fraudware: one based on Win32/Weelsof infection, and the other making use of the notoriously ubiquitous Reveton Trojan. Whereas the former pretends to originate from Metropolitan Police proper as the generic institution, the latter tends to get somewhat more narrow and specific in terms of the purported law enforcement subdivision, stating that it’s being generated by the Specialist Crime Directorate. Other than the list of criminal charges indicated on the hijack screens, the exhibited routine is identical: the virus jacks up the targeted PC, displays false accusations, and demands a fine payment.

Here is what the block pages look like:

Symptoms of being infected with PCeU ransomware

Along with obvious inability to use the infected computer due to the fake police warning showing up right after system startup, the malware is known to also do the following:

Police Central e-Crime Unit virus removal

Due to specificity of this infection, standard cleanup through the use of security software is barely applicable. Likewise, manual removal is considerably aggravated because of inability to access system directories where the virus embeds its components.

Thus, having thoroughly analyzed this malware, we came up with a number of removal methods that proved to be the most efficient for complete extermination of the PCeU Ukash virus.

PCeU virus removal using HitmanPro.Kickstart

For carrying out this removal procedure, you will need a USB drive to further launch the cleanup software from. Please note that all the data on this USB drive will be lost, so make sure you back it up before proceeding.

1. Download HitmanPro software to a computer that is not affected by the virus and save it to your Desktop. Before performing the download, be sure to select the version according to the bit-type of your Windows operating system (32- or 64-bit).
Get Hitman Pro
Support: Windows XP, Vista, 2003, 2008, Windows 7, Windows 8.
2. Plug in the USB drive that you are going to use for installing HitmanPro.Kickstart. Having inserted the thumb drive, double-click on the HitmanPro icon on your Desktop. The program’s main Window will appear. Please click on the kicker button as indicated by the red arrow on the screenshot below.
3. You will now see a window that will guide you all the way through creating the HitmanPro.Kickstart USB flash drive. Select the right USB drive by clicking on it in the corresponding field, and click the Install Kickstart button.
   The software will ask you whether the USB drive contains any important files (all of them will be erased). If there are none, click Yes on the alert. This will automatically initiate the install process. When it completes, click Close button.
4. Remove the USB drive and insert it into the computer infected with the PCeU virus.
5. When it is inserted, turn off the infested PC and switch it back on. As the computer is beginning launch, take a good look at the boot screen to find the key that should be pressed for accessing the Boot Menu or BIOS Setup. Please note that these keys may be different on different computer models. For entering the Boot Menu, those are mainly F10, F11, F12 or Esc buttons. The ones for BIOS Setup are usually Del or F2.
   Having determined the appropriate key for Boot Menu access, reboot and start hitting that key repeatedly as the PC is beginning to load. When in the Boot Menu, use its prompts to select the drive you want to boot your computer from, i.e. USB drive.
6. Now your PC will boot from the USB drive and load the HitmanPro.Kickstart saved to the memory stick. You will see a screen requesting you to choose USB Boot Options.
   You should press 1 as your choice. Doing so will be followed by Windows starting to load.
7. Right after Windows launches, the fake Royal Canadian Mounted Police block screen will appear as it did before, however in 15-20 seconds the HitmanPro main console will pop up on top of that.
   Please click Next on the program’s GUI.
8. On HitmanPro’s setup screen that appears, we recommend leaving the default installation settings as shown on the following screenshot:
   Please click Next.

PCeU virus removal using System Restore

This cleanup method allows restoring your operating system to the time period when it was not contaminated with the Police Central e-Crime Unit ransomware. This procedure will not lead to loss of any files. To perform system restore, please stick to the following steps:

Download, install and run reliable security software to get effective protection from cyber threats further on.