The State of Qatar Ministry of Interior CashU virus - How to remove

If your computer is blocked by a message stating that it is from State of Qatar Ministry of Interior, do not believe it. It is a scam developed by cyber criminals. The State of Qatar Ministry of Interior CashU virus is a ransomware that belongs to a wide Trojan family called Urausy. Viruses of this family are designed for many countries having the logo and the name of local police authorities and written in a language of that region. Trojan distributors put all their effort in order to make the blocking message look as scary and legitimate as possible. One of the tricks used is turning on a webcam if one is installed. Please note that even if you see yourself being filmed, your image will not be sent to any police authorities for criminal’s identification. Moreover, the crimes listed in the State of Qatar Ministry of Interior CashU virus message are made up. You are not actually charged with illegal using and distribution of movies, music or any other files.

The State of Qatar Ministry of Interior CashU virus demands a fine of 300USD (300 Euro or 1500 QAR) to be paid using cashU payment service provider. The latter system was chosen not accidentally. All ransomwares have prepaid payment systems listed as an option for collecting money because it is very complicated and in many cases even impossible to trace the criminals according to the PIN’s of cashU. There are several ways how criminals cash PINs into actual money: the sell them in underground forums at a reduced price or pay for illegal services to other criminals.

The State of Qatar Ministry of Interior CashU virus might be spread in several ways. The most common ones are infiltrating it into another website or using social engineering. If you visit a webpage that is corrupted, your computer might get blocked. The site does not necessary has to be adult one. It might be a simple job search site that got compromised. Trojan will not block your computer at once when you open such a web page. Usually it locks a screen several minutes (about 15 min) later in order to hide the place of its origin. If site admin has not removed such an infection, your PC screen might get locked again. Cyber criminals’ victims may also install this infection themselves manually thinking they get a useful update or application. You should always check if the update comes from an official application’s website.

Paying the fine the State of Qatar Ministry of Interior CashU virus asks for will not remove the bogus message. As soon as your PC screen got locked, follow the instructions below (you should use the option that is effective with the version of infection your computer has):

If there is more than one user’s account and at least one of them is not blocked

Login to the account that is not affected by the State of Qatar Ministry of Interior CashU virus and scan your computer with Spyhunter. The infection will be removed and other users’ accounts unblocked.

When it is possible to use System Restore

• Press and hold F8 while it is restarting in order to select safe mode with a Command prompt.
• At the command prompt, type cd restore, and then press enter.
• Type rstrui.exe and press enter (for Windows Vista, 7 and 8, you should type : C:\windows\system32\rstrui.exe; for Windows XP – C:\windows\system32\restore\rstrui.exe).
• When the System Restore starts, select a restore point previous to this infection. Do not forget to scan your computer with Spyhunter for the State of Qatar Ministry of Interior CashU virus files to be removed.

Method III – When the State of Qatar Ministry of Interior CashU virus does not block Safe Mode or Safe Mode with Networking

• Restart your computer. Press F8 while it is restarting.
• Choose safe mode or safe mode with networking.
• Launch MSConfig.
• Disable startup items rundll32 turning on any application from Application Data. Please note, that other locations can be also used.
• Restart the system once again.
• Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe. It should detect and delete the State of Qatar Ministry of Interior CashU virus. Watch a video guide of a similar virus illustrating the steps above:

Method IV – When the State of Qatar Ministry of Interior CashU virus does not block Safe Mode with Command Prompt

• Restart your computer choosing Safe Mode with Command Prompt.
• Run Regedit.
• Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe.
• Search registry for the State of Qatar Ministry of Interior CashU virus files and delete the registry keys referencing the files.
• Try to reboot and scan with Spyhunter.
• Here’s a video guide that illustrates the removal of a similar virus:

Method V – when none of the above worked use USB or bootable DVD

If you have an access to another computer, download Spyhunter to a bootable DVD or USB, insert it to an infected machine. The antivirus program will start automatically and remove the State of Qatar Ministry of Interior CashU virus.

Automatic Malware removal tools

Manual removal