Click on screenshot to zoom
Danger level 10
Type: Malware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Normal system programs crash immediatelly
  • Slow internet connection
  • System crashes
  • Cant change my homepage
  • Slow Computer

Metropolitan Ukash Virus

Metropolitan Ukash virus is a violent virus having an interface and translated into different languages. It is used to deceive computer users into thinking their machines have been locked by a particular organization representing song authors, composers and publishers. Depending on the targeted country, a different organization is presented. The virus paralyzes the system and pops up a warning demanding a considerable sum of money in the local currency so that the computer is “unlocked”. No operations on the infected computer are possible, because the threat disables access to the Internet and does not allow the user to launch any applications; hence, a spare computer with the Internet connection should be used to download a spyware removal program and remove the Metropolitan Ukash virus.

Metropolitan Ukash virus has 21 versions presenting different organizations. For example, the virus has attacked Polish computers in behalf of BIEM, which represents 56 countries from around the globe. The American infection claims that the user is being monitored by the Federal Bureau of Investigation (FBI). For example, there are two Spanish versions: one uses only the national police title Cuerpo Nacional de Policia, whereas the other has a logo of SGAE (Sociedad General de Autores y Editores). Other versions of Metropolitan Ukash virus are known as GEMA virus, Buma Stemra virus, PRS for Music virus, SACEM virus, GVU virus, SUISA virus, SPAUTORES virus, and AKM virus. The holders of the infected computers located in Denmark, France, Belgium, Spain, Canada, Sweden, Germany, Greece, Portugal, Italy, England, Holland, Switzerland and Austria are all accused of downloading pirated music, which is said to have been tracked with the help of the users IP address and hostnames, which are displayed in the middle of the message. The technique used to determine the victimized computer’s identifiable information is a strong factor that may lead the unsuspecting users into paying a ransom of $100, €100 or £50.

The users infected with Metropolitan Ukash virus are required to pay the ransom through its partner Paysafecard. For example, the virus spread in the UK blackmails its victims in this manner:

To unlock your computer and to avoid other legal consequences, you are obliged to pay a release fee of £50. Payable through our payment partner Paysafecard. After successful payment, your computer will automatically unlock.

Paysafecard enables Internet users to pay for their desirable items with a purchase code which is acquired online before the actual purchase of a product. However, this organization does not have anything in common with Metropolitan Ukash Virus, which should be removed once the malfunctioning discussed has been noticed.

More interestingly, only some versions of this infection want the user to pay through Ukash, another online paying system, and some presents both Paysafecard and Ukash. The later is like Paysafecard, because instead of an opening actual bank account to make a money transfer, a prepaid Ukash voucher is used. If you find any version of Metropolitan Ukash virus on your PC and do not remove it but intend to pay the “fine”, do not think that these two companies are responsible for the release of this destructive infection.

The best way to deal with any cases of Metropolitan Ukash virus is to remove it with the help of a legitimate spyware removal application that you can download on a spare computer and then transfer the installation files onto the infected PC or after rebooting your machine in Safe Mode with Networking. The use of the automatic removal of the infection is the only possible way to terminate the infection, because the virus does not allow anyone to access any part of the infected PC’s system.

To download a spyware removal tool, for example, SpyHunter, follow these steps:

1. Restart the computer and before system loads press F8.
2. System boot menu will appear. Choose Safe Mode with Networking and press Enter.
3. When Safe Mode with Networking loads, access the Internet and download SpyHunter from http://www.pcthreat.com/download-sph
4. Install SpyHunter on your computer and launch the program to remove Metropolitan Ukash Virus.

If you have Windows XP:

1. Follow steps 1 to 3 described above.
2. Open Start menu and click on RUN.
3. Enter “msconfig” into the box and press Enter.
4. System Configuration menu will appear. Click on Startup tab.
5. Uncheck all programs that are set to load automatically and press OK to save changes.
6. Restart your computer again, load it in Normal mode and install SpyHunter.
7. Remove Metropolitan Ukash Virus with SpyHunter automatically.

If have any difficulties downloading SpyHunter or removing the virus, leave your comment below.

Download Spyware Removal Tool to Remove* Metropolitan Ukash Virus
  • Quick & tested solution for Metropolitan Ukash Virus removal.
  • 100% Free Scan for Windows
disclaimer
Disclaimer

Comments

  1. Christian Jan 11, 2013

    I have a problem following your guide. I am using Windows XP and have tried restarting the computer in Safemode to be able to enter the msconfig in RUN.
    But as i started my computer in Safemode the malware opened anyway, why I am not able to enter the command.
    What could I have done wrong or what can I do instead?

  2. Pcthreat Jan 14, 2013

    Hello Christian,

    This will work if you have a good system restore point:

    Step 1: Use F8 to Boot to SafeMode With Command Prompt
    Step 2: Type the word "explorer" in black screen > enter
    Step 3: Then Navigate to:
    Win XP: C:\windows\system32\restore\rstrui.exe and press Enter
    Step 4: Restore Computer to Date you know you were virus free

  3. Laurence O'Brien Jun 28, 2013

    I HOPE THI WORKS!

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.