It appears that the white screen virus below is associated with the ICSPA UKASH scam, and at least one of the jobs below shows symptoms of both. I have just has another ICSPA UKASH infections, the symptoms of which are a white screen at start up, which turns into a scam screen claiming that you have been downloading music, videos or objectionable material. As the site you downloaded the virus from was probably an example of such a site, they are on to a safe bet. The site pretends to be generated by the Australian police, and has an option to pay an instant fine of $100 using the UKASH option, a voucher that it says you can buy from Whitcoulls. Whitcoulls no longer sell UKASH, so the scam is a waste of time now. However, the computer is still infected.

I struggled with this for a few hours, trying the methods I used below, none of which worked, but the answer is a lot simpler, simply a system restore.

I started the system in Safe Mode with command prompt (this stops any chance of the malware doing its stuff) and do a CD to the directory where rstrui.exe lives (c:/windows/system32/restore), and then execute rstrui.exe, and choose an appropriate restore point, before the infection would make sense! This gives you the ability to start the computer, and to the run the usual anti malware jobs.


Dave Glover is a director of Signs of Success Ltd. married to Lynn (the other director of SOS) with 3 grown up kids. We live in Whitby, in New Zealand. After 30+ years in IT as everything from Trainee Programmer to Project Manager, Dave now runs a Computer Maintenance and Sign Making shop near his home.

Posted in Computer Stuff

Leave a Reply

Your email address will not be published. Required fields are marked *