Click on screenshot to zoom
Danger level 9
Type: Malware
Common infection symptoms:
  • Block exe files from running
  • Changes background
  • Connects to the internet without permission

CashU Virus

CashU Virus is variation of Ukash Virus intended for Arab countries, because CashU is an alternative payment system popular in Arab countries. In case of this CashU virus, it targets users in United Arab Emirates, claiming that it displays a message from Abu Dhabi Police GHQ, and that your computer has been locked because of illegal cyber activity. That is why CashU Virus is classified as ransomware. It means that computer malware gets into your PC, locks you out of your desktop and then displays a fake notification that asks you to pay money for something you have not committed. The bottom line is that you need to remove CashU Virus from your PC at once, otherwise the malware will continue to terrorize you.

The infection is distributed by Urausy Trojan, so this infection is actually only another version of such threats as Urausy FBI Moneypak Virus, Policia Boliviana Virus or Dirección General de la Policía Virus. The only difference is that CashU Virus presents its security notification in Arabic, but other than that, the message displayed is practically the same. The creators of this infection simply take one text, run it through an automatic translator, and then paste it into the message that gets distributed by the Urausy Trojan. That is why there are usually grammatical and syntactic discrepancies in the message.

To sum the notification up, CashU Virus says that your computer has been locked, because you have been engaged in storing and distributing copyrighted material (such as music, video or software). It also says that illegal files of child pornography and bestiality have been detected on your computer, and it also means that you have breached several laws in the United Arab Emirates. CashU Virus claims that you need to pay a fine of 500 dirham, 100 USD or 100 EUR within 72 hours since the infringement, otherwise your computer will be locked permanently, and your information will be sent to law enforcement authorities.

Needless to say, that you must not do so. If you transfer your money via CashU, you will never get it back, and your computer will remain infected with CashU Virus. You need to restore your desktop access and remove CashU Virus yourself.

How to unlock your PC

Instructions for Windows 8

  1. Press Windows key for metro Start menu to appear. Move mouse cursor to the bottom right corner of the screen.
  2. When Charms bar appears, click Settings and click Change PC Settings. Select General and scroll down to Advanced Startup.
  3. Click Restart Now and go to Troubleshoot. Select Advanced Options and click Startup Settings.
  4. Click Restart and wait for BIOS to load.
  5. Press F5 to choose Safe Mode with Networking.
  6. Access http://www.pcthreat.com/download-sph and download SpyHunter.
  7. Install the program and perform and full system scan.

Instructions for Windows Vista & Windows 7

  1. Restart the PC and tap F8 repeatedly.
  2. Select Safe Mode with networking and press Enter.
  3. Go to http://www.pcthreat.com/download-sph and download SpyHunter.
  4. Install the program and run a full system scan.

Instructions for Windows XP

  1. Follow the steps 1 and 2 above.
  2. Click Yes and when confirmation box appears.
  3. Download SpyHunter.
  4. Open Start Menu and launch Run.
  5. Type "msconfig" into Open box and click OK.
  6. Select Startup tab on System Configuration Utility.
  7. Select Disable all and press OK.
  8. Restart the PC in Normal mode.
  9. Install SpyHunter and scan your computer.

Should you have any question about CashU Virus removal, leave us a comment below.

Download Spyware Removal Tool to Remove* CashU Virus
  • Quick & tested solution for CashU Virus removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove CashU Virus

Files associated with CashU Virus infection:

m2PythonLoader.exe
msn.exe
2084473.dll
xaZYOVJW.exe
install_0_msi.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
audipbrd.exe
UpdatePriv.exe
n.
VaultSysUi.exe
mplayer2.exe
msshell.exe
%UserProfile%
3511172082012Build.exe
魔法桌面第三方主题破解补丁V1.1.exe
bf8h8d02hf.exe
%LOCALAPPDATA%\lollipop
yaiiwockc.dll
taskhost.exe.exe
skype.dat
wgsdgsdgdsgsd.exe
C87C.exe
zqmkrehUkpoKfsafsaZg.exe
%APPDATA%\system
Firewallservice.exe
setex.exe
ifgxpers.exe
96dddda4.dll
Task Scheduler.exe
xctqakcqbeo.dll
00b5d693.exe
ACEIEAddOn.dll
50E1.exe
securitywindrv.exe
WinSyncMetastore.exe
DA0B.exe
dyjdl.exe
uenovfiu.exe
ssntvs.exe
MusicCollector.exe
msdtmsrd.exe
idiokbbrv.exe
%APPDATA%\Task Scheduler
%APPDATA%\updates
Piranha.exe
acuvzomo.exe
OmaSG21e.exe
%WINDIR%\Temp
dqnbdq7.dss
oygqyunapnp.exe
pYunY8m4VL3qLc.exe
msnmsgrr.exe
wjthvwjb.dss
xlqbteeb.exe
puozlkmyj.dll
rool0_pk.exe
iner.exe
msavfit.exe
UpgradeHelper.exe
pmstcdjwz.exe
crack.exe
ubvhynpxh.exe
%TEMP%
bvhylsviw.exe
87b2cb3916261d5c807bf44262755cb0.exe
xmlfilter.exe
Other.res
b34btbztdb0vavaw.exe
wahneaqa.exe
DLL321.dll
systemcpl.exe
%ALLUSERSPROFILE%\Application Data
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
videotwisterSA.exe
%ALLUSERSPROFILE%
Nbt.exe
bzsbkotiu.exe
00qbipeq.exe
aPr0hY9.exe
comeo.exe
najeoxtt.exe
SyncHostps.exe
ctfmon.exe
svchost.exe
NTServiceManager.exe
Q3d38543.exe
ieudator.dll
secproc_isv.exe
wlsidten.exe
ex3b.dll
questscan.dll
wlsidten.dll
%LOCALAPPDATA%\Temp
jsdhlexdqkllnbcxgai.bfg
gcrwcoak.exe
TimeDateMUICallback.exe
%WINDIR%\system32
p1.exe
Updating.exe
administration.exe
WINDED6.exe
%SystemDrive%\????????????
dtkmujvo.exe
csrsss.exe
sqlncli.exe
scvhost.exe
JfCqQ5JC.exe
hwj3ba6j.dss
rvcbcyks.exe
obvwo.exe
brenasa.exe
%AppData%
%CommonProgramFiles%
wpbt0.dll

CashU Virus DLL's to remove:

wlsidten.dll
xctqakcqbeo.dll
DLL321.dll
ieudator.dll
puozlkmyj.dll
questscan.dll
ACEIEAddOn.dll
wpbt0.dll
2084473.dll
96dddda4.dll
yaiiwockc.dll
ex3b.dll

CashU Virus processes to kill:

comeo.exe
Nbt.exe
魔法桌面第三方主题破解补丁V1.1.exe
systemcpl.exe
ssntvs.exe
bvhylsviw.exe
aPr0hY9.exe
bzsbkotiu.exe
TimeDateMUICallback.exe
mplayer2.exe
50E1.exe
msavfit.exe
sqlncli.exe
Task Scheduler.exe
wgsdgsdgdsgsd.exe
rvcbcyks.exe
xmlfilter.exe
svchost.exe
UpgradeHelper.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
administration.exe
wlsidten.exe
Updating.exe
taskhost.exe.exe
secproc_isv.exe
WINDED6.exe
uenovfiu.exe
00qbipeq.exe
xaZYOVJW.exe
Piranha.exe
m2PythonLoader.exe
acuvzomo.exe
dyjdl.exe
oygqyunapnp.exe
brenasa.exe
JfCqQ5JC.exe
csrsss.exe
3511172082012Build.exe
scvhost.exe
xlqbteeb.exe
msnmsgrr.exe
setex.exe
87b2cb3916261d5c807bf44262755cb0.exe
dtkmujvo.exe
SyncHostps.exe
najeoxtt.exe
crack.exe
obvwo.exe
videotwisterSA.exe
ubvhynpxh.exe
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
OmaSG21e.exe
VaultSysUi.exe
rool0_pk.exe
Firewallservice.exe
msn.exe
idiokbbrv.exe
DA0B.exe
ifgxpers.exe
pmstcdjwz.exe
WinSyncMetastore.exe
UpdatePriv.exe
Q3d38543.exe
00b5d693.exe
iner.exe
C87C.exe
msdtmsrd.exe
b34btbztdb0vavaw.exe
securitywindrv.exe
zqmkrehUkpoKfsafsaZg.exe
audipbrd.exe
ctfmon.exe
MusicCollector.exe
msshell.exe
install_0_msi.exe
pYunY8m4VL3qLc.exe
p1.exe
NTServiceManager.exe
wahneaqa.exe
gcrwcoak.exe
bf8h8d02hf.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.