FBI Moneypak on my desktop

I'm using a laptop to write this because my desktop won't boot up except partially in regular mode...at which point it shows the FBI moneypak screen...only way I found out it was malware was when I called the FBI office in Salt Lake City.

I cannot reboot in any other mode (safe, etc.), so cannot access the internet, needless to say, and I won't be able to do any of the "read-me-first" until I can get beyond, or avoid that deadly "moneypak" screen.

I am hoping there is something that can be done under specific direction from the awesome Majorgeeks squadmembers to revive this machine: Dell Dimension 8200 (with barely enough memory to be running Windows XP Home edition).

Even if this can be worked out, I realize this might be a long, long process, but thank you in advance for any help...Right now things seem to be hopeless...:cry

 

Hi Kestrel 13!,

Thanks for your reponse; I appreciate it alot!

I have some concerns before I proceed with the Kaspersky application. Perhaps you could advise.

1) Foolishly, before contacting the forum I reloaded my copy of Windows XP Home Edition, which (I believe) is not the Service Pack 2 Edition. And at this point, I cannot download the svc pack 2 upgrade from the Microsoft site because I'm locked off the internet with that machine.

2) In reading the Kaspersky software spec requirements I believe that I must have the Service Pack 2 upgrade installed before trying to use Kaspersky Windows Repair procedure.

Is this a major problem, and must I seek another work-around in order to avoid getting into deeper trouble?:confused

Thanks for your continued "aid" in this situation.

 

In answer to your question, I had Advanced System Care set to automatically log me in as the default user on the machine. On startup the computer does a normal windows startup without stopping at the user log-in screen. So I have no way to run any of the tools on the computer before it locks up

Unless I hit F-8 or F-12 when starting it, the computer goes straight to logging me in, and then it goes all the way through the bootup process to the ransom screen without allowing me to interact with the computer in any way.

When I start it and immediately hit the function keys (f-8, f-12), I can get to the appropriate screen, but I cannot successfully choose any of the alternative (safe mode) boot processes. Even when choosing the Windows Repair Console, what eventually comes back is the black (DOS?) screen with the cursor: C:\windows> ...not the Repair console, so that's out.

It appears I might have three alternatives:

1) BAD; Do not intervene when starting up the computer, in which case it ends (locked) in the FBIMoneypak ransom screen.

2) Strike the F-12 Key and then choose to start up through the CDRom disk, and I'm not certain what kind of disk would work to get around this problem, unless using Kaspersky...problematic i.e. previous posts.

3) (Probably impossible?) Try to work in the DOS screen (C:\Windows>) some way to get in the back door...

One thing I hadn't mentioned before is that I have a Maxtor external hard drive as a backup to this main hard drive. I haven't a clue as to whether or not, nor how, this could serve as part of a solution to this "prickly" problem. I simply have had the external running at all times, keeping a current copy of the C drive.

Thanks again for any further help/advice you might be able to give. :-o

 

Hi Kestrel13!

I was not able to boot with the CD; however, I was able to bring up Task Manager and log out during the infamous "Ransom" lockout process before it reached the final screen.

Then I logged in on my spouse's account, and ran the FRST.exe scan, but I think it wasn't able to scan properly because the machine had not been able to "boot to recovery environment by using a PE boot CD."

Nevertheless, I am attaching the resulting log per your instructions.

I am assuming that, since the ailing desktop computer is in even a crippled operating mode (constant messages that a certain process couldn't be started, no internet connection, --and I haven't turned it off), I might be able to get logs to attach to future posts.

I should be able to use this good computer to download the repair tools for scans you need me to do and then proceed to get logs to submit that way, NO?

Your help thus far is SOOOOO appreciated, I assure you.

 

Trying to attach it to this post...again. Meanwhile downloading tools and trying to get logs to attach to subsequent posts.

Thanks again!

 

Can't believe how much I messed up when re-installing Windows XP before contacting the forum.

Am attaching the only logs that I was able to get: MGtools and Hitman Pro.

It seems I will not be able to eliminate the threats spotted by Hitman Pro without purchasing a copy, because a message said that the license had expired. Evidently I had downloaded a copy a while back when having other troubles, but cannot remember actually having used it.

TDSSKiller would not start, not even giving me any messages.

When trying to start RogueKiller, I got this message: Entry Point Not Found, The procedure entry point Decode Pointer could not be located in the dynamic link library KERNEL32.dll.

Malware Bytes gave me the option of starting with the following warning: Your version of Windows is outdated and presents a severe threat to the security of your system. Malwarebytes Anti-Malware requires at least Windows Service Pack 2 to be fully functional. It is highly recommended that you upgrade Windows. Do you want to continue with installation anyway?

Needless to say, I opted not to install Malwarebytes after that warning without communicating with you first. Do you think it worth the risk to proceed with usiing that tool (Malwarebytes)?

Therewith, again I thank you for slogging through this mess with me. Hope you see some "light" in the two logs attached.:-o

 

Thank you for your quick feedback, Kestrel13!

Attached is the MBRCheck log you requested.

Hope it helps!!

:wave

 

I did as you directed in your last post. I had to run it twice, because the first time after rebooting (having done the scan) it showed that one of the bad files was still resident on the drive.

At least I can log in on my account, but don't have access to the internet, and the vsmon.exe part of the windows process is not able to initialize.

Have attached the last two logs. I appears the three problem files are no longe resident/active.

 

Yes, until recently. Of course not now; it's useless because I can't get on the internet since that problem with the FBI Moneypak Trojan.

I don't think it is working properly since I re-installed Windows XP and I haven't been able to do windows updates and install Service Pack 2 in order to see if I can get it to act normally again.

The following are some concerns:

Not able to access the Internet

Cannot boot in anything but normal mode...other alternatives are not viable (safe mode, and all variations thereof, as well as the repair console).

Good news, the CD/DVD drive is back as a resource.

Other problems: Still cannot run TDSSKiller, RogueKiller, and Malwarebytes doesn't want to be used until Service Pack 2 has been installed.

Sorry for the bad news, but thought you would like to know about some trouble spots since you asked me to let you know.

Thanks again; will appreciate ongoing directions.:confused

 

Did all as directed up to "Run Repair_Windows.exe by clicking on it."

Received the following message: "This application hsa failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem."

Proceeded to re-extract from the thumb drive to the desktop several times, then came back to this laptop and downloaded the zip file once again and repeated the process of creating the folder on the desktop of the ailing unit. Unfortunately, no go again...the same message as above.

Any ideas as to whether or not I'm doing something wrong? I've done this type of thing before, but haven't had trouble making an .exe file open. However, this is a different situation from any other.

Sorry...

 

I am not able to boot up in any mode other than Normal Mode (safemode, safemode with...etc, are all non-functioning).

(Command Prompt) ? C:\Windows> appears when trying to access the Windows Repair console, and then when I type "exit" it recycles to the normal bootup.

On a possitive note, I can put the original Dell Operating System Reinstallation CD of Windows XP Home Edition in the CD drive. When I click on Setup.Exe it brings up the main screen with the following options:

1. Install Windows XP
2. Install optional Windows Components
3. Perform additional tasks
4. Check system compatibility

I even tried to put the Windows Repair download on a CD on the laptop (rather than the thumb drive I'd originally tried) to transfer to the ailing desktop, but the Windows Repair Zip file did not show up on the crippled units cd drive when I put in the disc I had made.

Sorry to keep running into dead ends... Hope there are a few alternatives still available.

Too bad these haven't worked as well as Hitman Pro did.:cry

 

YAAAAAAAY!!!!!

Yes!!!! Everything was successful from your last post.

For future reference, since I am doing all of this on a laptop and then carrying it over to the ailing desktop, doing the regedit had to be done in two stages:

1. On the laptop I copied and pasted to notepad, then saved it as fixME.txt to the thumb drive.

2. On the ailing desktop I opeed and copied the regedit text from the thumb drive and pasted it into notepad opened up on desktop, then saved it as fixMe.exe (all files) on the desktop.

Just thought I would clarify in case anyone else is transferring regedit fixes from a good computer to bad computer desktop.

I got a successful message after double clicking on the fixMe.exe on the desktop. YES!

Ran MGtools; have attached the MGlogs.zip

 

Negative on both counts. After numerous cold boots and re-boots, essentially there are no changes beyond the changes made when eliminating the lockout FBI Moneypak page.

Still not able to log on to the internet, not able to run the Windows Repair utility, and still not able to run the other utilities from the Read and Run Me First procedures.

Sorry...I cannot understand why there aren't any changes after having got the "success" message in that last operation.

Still hanging in and hoping to get things back together with further direction.

Thanks again.

 

Downloaded and ran the fix. No apparent change of any kind in being able to access the internet with the hurting computer. Even ran it a second time.

Thanks for the direction.

Hope there are other possibilities:-o

 

Hi; thanks for your continued help.

BITS is present, inactive, manual startup type (hope that's what you're asking).

Have attached screen captures relevant to wider issues in the problem. Second attachment, errors when clicking on Internet Explorer icons on the desktop.

Do You think the following procedure might be appropriate in this situation? Just thought I'd ask.

Now continue with the below which will attempt to repair your network connection
1. Go to Start ==> Run (or Windows key+R)
o Type the following in the run box and click OK: notepad c:\windows\inf\nettcpip.inf
(note that there is space after notepad)
o The above file will open in the notepad.
o Under TCP/IP Primary Install section find the following: Characteristics = 0xA0
o Edit 0xA0 and replace it with 0x80 (replace A with 8)
o Under File menu click Save and close the notepad.
2. Go to Start ==> Control Panel. Double-click Network Connections. Right-click Local Area Connection, and select Properties.
o On the General tab, click Install a popup window opens.
o Select Protocol from the list and then click Add.
o A new window opens, click Have Disk....
o In the browse... box type c:\windows\inf
o Click OK.
o Select Internet Protocol (TCP/IP), and then click OK.
o On the Local Area Connection Properties screen select Internet Protocol (TCP/IP) and click Uninstall, and then click Yes.
o Wait until it asks to restart, and then restart as requested. Continue with the below after restarting.
3. Go to Start ==> Run (or Windows key+R)
o Type the following in the run box and click OK: notepad c:\windows\inf\nettcpip.inf
(note that there is space after notepad)
o A file opens in the notepad. Under TCP/IP Primary Install section find the following: Characteristics = 0x80
o Edit 0x80 and replace it with 0xA0 (replace 8 with A)
o Under File menu click Save and close the notepad.
4. Go to Start ==> Control Panel. Double-click Network Connections. Right-click Local Area Connection, and select Properties.
o On the General tab, click Install
o A popup window opens. Select Protocol.
o A new popup window opens. Select Internet Protocol (TCP/IP), and then click OK.
o Wait until it asks to restart, and then restart as requested. Continue with the below after restarting.
5. Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

 

Thank-you for your latest help.

Downloaded and ran ComboFix on the broken computer, and have attached the results.

Best regards, Kestrel13! Appreciate your continued direction.

Zamorazeke

PS Just noticed latest post from Chas Lang, and I'm working on directions now. Thanks...

 

Thank you so much for the last post.

Downloaded Service Pack 2 Installation utility as well as both C++ SP1 2005 and 2008.

Installed Service Pack 2.

After rebooting, it appears the computer is operating almost normally. Even ZoneAlarm updates functioned normally...meaning it had access to the internet.

However, all IE shortcut icons on the computer have been changed. None of them initiates the IE program to access the internet. No access to Internet at this poiint. When I dcouble click on the default IE icon (the 'e') on the desktop it creates another 'e' that is a shortcut. It will create another shortcut each time I double click on it to access Internet Explorer.

Other processes appear to be working normally (I think).

I want to extend another sincere thank-you at this point for your continued help, and I will gladly follow further directions.

 

Thank you

Ran C++SP1 2005, then ran MGTools and have attached the log.

 

Thank you for your rapid response chaslang;

Sorry I can't figure out what to do to connect to the Internet...

Have attached screen capture of message received when clicking on the .exe file in the Internet Explorer program folder. Also attached is illustration of how the desktop shortcuts have changed since SP2 install.

All the desktop shortcuts to Internet sites have changed. There was no problem......there were not any apparent changes from their normal internet explorer (shortcut) icon appearance before running the SP2 install utility.

After running the SP2 app (on reboot) all the shortcuts to websites on the desktop changed to white squares with the same titles underneath they had before. However, both before and after running the SP2 install app I could not, and still cannot, get on the internet, even though the modem connection apparently is operational, according to information sent in earlier.

Certainly, added direction in troubleshooting will be greatly appreciated.

 

Yes, Firefox finished opening (after I clicked "okay" button in the screenshot message attached).

Indeed even Apple Safari browser opened normally without a hitch.

Go figure:confused

 

I'm not clear about the procedures you are directing me to perform...

If IE8 is broken, and Firefox works, why am I trying to uninstall an old copy of Firefox and installing a new copy of Firefox?

Does that address the IE8 problem, or are you saying I need to initiate a thread about IE8 on the software forum, and are they the ones who can direct me in how to repair IE8?

Thank you for your reply; will appreciate any clarification you might give to the questions above

 

Thank you, Chaslang for all your help this week.

I've started a thread in the Software forum, and I'm seeking further direction because I don't trust myself to do things in the proper sequence if multiple steps/operations will be necessary to get IE8 back again.

Please accept my thanks again, and have a good week.:wave

Zamorazeke.