The Kingdom of Jordan CashU Virus - How to remove

The Kingdom of Jordan CashU virus is a ransomware that belongs to the wide family of Trojans called Urausy. It locks an infected computers’ screen with a message informing about various crimes breached. These usually are related to illegal usage and distribution of copyrighted content such as videos, music, films, software, using computer for sending Spam and even viewing and distributing of pornographic files. The message is supposed to be from the Public Security Directorate, the law enforcement agency of this country. To make it look even more legitimate scammers programmed the Kingdom of Jordan CashU virus to turn infected computer’s camera on and film surroundings. The text explains that this data is sent to responsible authorities for criminal’s identification. The fine that is asked to be paid in order to remove these fake charges is as big as 300USD. It should be paid using prepaid payment system – CashU.

The Kingdom of Jordan CashU virus as many other ransomware is distributed using several methods. Besides malicious attachments in spam e-mails and corrupted files promoted via peer-to-peer file sharing means scammers tend to attack legitimate websites and infect them. Compromised web pages become a platform for spreading the virus. One more way of infecting computers is using social engineering which is tricking people into installing the infection themselves thinking it is useful software or an update.

There is no need to tell that paying the fine will not remove the blocking from your computer. moreover, it will only fund further development of similar viruses. The only reliable the Kingdom of Jordan CashU virus removal is by using special antimalware tools and following strict instructions. Please note, there is more than one version of this Trojan therefore you should apply the steps that best suit your situation.

Method I – using unaffected user’s account

If you have more than one user’s account and at least one of them is not infected, login to it and scan your computer with Spyhunter. The Kingdom of Jordan CashU virus will be removed and other users’ accounts unblocked.

Method II – using System Restore

• Press and hold F8 while it is restarting in order to select safe mode with a Command prompt.
• At the command prompt, type cd restore, and then press enter.
• Type rstrui.exe and press enter (for Windows Vista, 7 and 8, you should type : C:\windows\system32\rstrui.exe; for Windows XP – C:\windows\system32\restore\rstrui.exe).
• When the System Restore starts, select a restore point previous to this infection. Do not forget to scan your computer with Spyhunter for the malicious files to be removed.

Method III – using Safe Mode or Safe Mode with Networking

• Restart your computer. Press F8 while it is restarting.
• Choose safe mode or safe mode with networking.
• Launch MSConfig.
• Disable startup items rundll32 turning on any application from Application Data. Please note, that other locations can be also used.
• Restart the system once again.
• Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe. It should detect and delete the Kingdom of Jordan CashU virus. Watch a video guide of a similar virus illustrating the steps above:

Method IV – using Safe Mode with Command Prompt

• Restart your computer choosing Safe Mode with Command Prompt.
• Run Regedit.
• Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
• Search registry for the Kingdom of Jordan CashU virus files and delete the registry keys referencing the files.
• Try to reboot and scan with Spyhunter.
• Here’s a video guide that illustrates the removal of a similar virus:

Method V – using USB or bootable DVD

If none of the above worked and you have an access to another computer, download Spyhunter to a bootable DVD or USB, insert it to an infected machine. The antivirus program will start automatically and remove the infection.

Automatic Malware removal tools

Manual removal