Ministry of Public Safety Canada Ransomware

The Ministry of Public Safety Canada Ukash ransomware belongs to the Troj/Urausy group of screen lockers. Once it has compromised a computer, it displays a warning stating that the computer has been blocked for safety reasons related to illegal file downloads such as, music, video and warez files. The Ministry of Public Safety Canada ransomware also stats that you must pay a fine in the amount of CAD $100 within  a 48 hour period to avoid criminal prosecution. The warnings are all fake and should be ignored.

How to remove  the Ministry of Public Safety Canada ransomware

Since the ransomware will prohibit you from accessing a web browser on the infected computer, you will need to download the needed utilities on a known clean computer and then transfer them to the infected computer on a burned cd/dvd or possibly a flash drive.

You will need  to download a copy of:

  1. Once you have downloaded and burned the needed files to a cd, insert the burned disk into the infected computer and then reboot it into "Safe Mode with Command Prompt".

  1. After the system reboots, log back into your account.
  2. Once the command prompt appears, navigate to the external drive where the downloaded software is located. If the files are on a cd/dvd, type "D:" or possibly "E:" at the command prompt to navigate to the external drive. Afterwards, type "Dir" at the prompt to make sure you're working on the correct drive.

  1. Next, execute the copy of "Rkill" by typing "rkill.exe" at the command prompt. It will quickly terminate any malicious processes it detects running on your computer.

  1. After "Rkill" has finished it's work, start the copy of Combofix by typing "combofix.exe' at the command prompt. If you have an anti-virus installed that is currently monitoring your system, combofix will prompt you with a warning. If it does warn you about your anti-virus, terminate it at this point and then sskip to the next step. If no warnings are shown, then proceed with the Combofix scan and removal procedure. It will take around 20 minutes or more to complete.

  1. Once Combofix has completed, decompress the copy of Emsisoft Emergency Kit by typing it's executable at the prompt. Extract it to an easily accessible folder in the root of the "C" drive.
  2. Once the kit has been extracted, navigate to it's folder by changing drives. This can be done by typing "C:" at the prompt. and then type "CD: The Name Of The Emsisoft directory:

  1. Once in the proper directory, execute the copy of the Emsisoft Emergency kit by typing "Start.exe" in it's containing folder.
  2. Next, click on "Emergency Kit Scanner"

  1. Next, perform a deep scan of your computer and then remove any malicious files and registry entries that it finds on your computer.

  1. Afterwards, reboot the computer normally.

Your computer should be clear of the Ministry of Public Safety Canada ransomware. If it still shows signs of the ransomware infection, you may need to contact a professional computer virus removal specialist to resolve your virus infection issue.

Smith Technical Resources makes no guarantees or claims that the information contained in this article will help you completely remove the above listed malicious program(s) from your computer.  There are several variations of each particular virus in the wild . And the procedure listed above may not be adequate for the specific version of the virus that your computer has been compromised by.

If you feel uncomfortable performing any of the procedures that we've listed on this page, please contact a professional computer repair company in your area and have them complete the needed repairs on your computer. Smith Technical Resources takes no responsibility for any possible damage that could result from your use of the above instructions.

Windows advanced options menu Windows command prompt Windows command prompt

© 2013 All Rights Reserved. Website Privacy Policy. Site Map

Windows command prompt example Microsoft Windows Command Prompt Emsisoft Emergency Kit Interface Emsisoft emergency kit deep scan screen
Share on Twitter Share on Stumble Upon Share on Digg Share on Delicious

Providing cost-effective local computer repair and network support in the middle Tennessee area

Remote Access Portal

Remote Access Icon
Home About Us Onsite Services Online Services Self Help Pricing Blog Inquiries

Related Tutorials That May Be Of Interest To You

  1. FBI MoneyPak Virus Removal Tutorial
  2. Mandiant USA Cyber Security Ransomware Removal Tutorial

Mandiant Logo FBI Logo

You may also be interested in the following tutorials: