Politie Federal Computer Crime Unit

BILLMCC66 · Feb 7, 2013

has anyone else come across this virus??

http://malware-removal.windowsupdat...virus-asking-for-100-euros-to-unlock-your-pc/

It appears to have been around for a while but it has only just hit Belgium and it is going through the internet here like a wild fire.
I have done three PCs this week with this beast, It locks the owner/operator out of the PC completely and the only way i have found to clean it is to pull the HDD and reclaim the data from it by connecting it to anothe PC (via sandboxie) and then formatting it and re-installing the OS,
There may be other ways but this was the easiest for me.

DavidGP · Feb 7, 2013

Hi Bill

I see this is back in the press again this week also http://www.bbc.co.uk/news/technology-21291925

Yes, last year on a PC I was asked to work on by a friend, nasty little bugger too, but with using the Malware Guide and knowing what should be starting with a PC (as in what files looked suspicious) I managed to fix this PC.

It took a while though and had to get into safe mode first.

But this maybe a newer version of this malware than I came across, but the image was the same.

Phantom · Feb 7, 2013

Yeah, this is just another flavour of 'Ransom-ware' that is floating about the 'Net a lot lately. It can be removed, but there's a few tricks to it.

dr.moriarty · Feb 7, 2013

Hi ya, Bill

I've read of 20+ global law enforcement agencies' names being used in this ransomware threat, and we've been dealing with the "FBI Moneypak" version since last June.

-Press Ctrl-O (that's the letter O, not the number zero).

-Select "Browse", go to c:\windows\system32 and open cmd.exe.

-Type "explorer.exe" into the newly opened window. You should now be able to use the desktop again.

* Try looking in the Startup folder and delete any entries you don't recognize.

On Windows XP
%USERPROFILE%\Start Menu\Programs\Startup\

On Vista & Windows7
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Also look for weird temp filenames like (without quotation marks) “festOr_ot” . “roolO_pk.exe”, “er_OO_O_l.exe” and/or a “.mof “ file by clicking Start>Run>Type %temp% >OK
Click to expand...

Then look for left-overs by running Malwarebytes'

# Sometimes more work is needed than just the above! I would run the full R&R Me FIRST guide.

Fred_G · Feb 7, 2013

Had that on one of the PC's at work. Was a nasty one, I just gave up and formated it. Sucker would not go into safe mode, and would not give me enough time to do anything before locking up.

I got a kick out of them wanting me to pay the FBI via a money order from CVS... -D

I don't live in a huge city, but we have a FBI office.

Log in or Sign up

Politie Federal Computer Crime Unit

BILLMCC66 Bionic Belgian

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

Phantom Brigadier Britches

dr.moriarty Malware Super Sleuth Staff Member

Fred_G Heat packin' geek