Have anybody got this NEW computer virus?

YBE

Banned
Joined
May 2, 2012
Messages
5,125
Reputation
9
Daps
5,515
Try system restore first. If that don't work, then call the technical support of the company brand of your computer and ask them how to reinstall Windows for you.

I remember when I was a broke nikka I had this shyt all down. If you don't activate Windows, it only lasts 30 days or some other limit, i forgot. fukk I look like paying $200 for Windows when I barely had a job then? :huhldup:

I'd just save all my important files on USB drives/CDs & every 30 days, I'd do a clean scrub on my computer, restart the operating program & go back on the 30 day trial :obama: :pachaha: Was like i had a brand new pc again :obama: The story applies here because I realized if I caught a bad virus, it got rid of it :gladbron: I don't even know how I figured that shyt out. I was just clicking on partition here, partition there & voila :huhldup:
 

StarClout

Moderator
Staff member
Supporter
Joined
Jun 6, 2012
Messages
9,524
Reputation
3,720
Daps
24,110
Reppin
Broncos/NYY/NYR/ALA

Golayitdown

Veteran
Joined
Apr 30, 2012
Messages
24,484
Reputation
4,948
Daps
82,717
I remember when I was a broke nikka I had this shyt all down. If you don't activate Windows, it only lasts 30 days or some other limit, i forgot. fukk I look like paying $200 for Windows when I barely had a job then? :huhldup:

I'd just save all my important files on USB drives/CDs & every 30 days, I'd do a clean scrub on my computer, restart the operating program & go back on the 30 day trial :obama: :pachaha: Was like i had a brand new pc again :obama: The story applies here because I realized if I caught a bad virus, it got rid of it :gladbron: I don't even know how I figured that shyt out. I was just clicking on partition here, partition there & voila :huhldup:

In the rare occasion that I do want to reinstall windows (or sometimes Linux), those partitions have me like :win:....all my data is already stored off and all I have to do is install the OS.. I'm usually up and running within 45 minutes....
 

TrueEpic08

Dum Shiny
Joined
May 1, 2012
Messages
10,031
Reputation
921
Daps
17,183
Reppin
SoCal State Beaches
System Restore or Malwarebytes should do the trick for you, but if that doesn't work, do this:

Occasionally, the virus will wipe your restore points completely. If this happens, start your computer in safe mode with networking, and do this:

1. Open the start menu and type "%appdata% in the search field and press Enter (If you're running XP, select Run and do this).

2. Go to Microsoft\Windows\Start Menu\Programs\Startup and there should be a file there titled "ctfmon.lnk". Delete that, that's causing the screen to come up on startup (I forget if it's different on XP and the laptop that I was running it on is fukked, so I'm not looking on it)

3. Run "%userprofile%, go to Appdata\Local\Temp and remove the files titled "rool0_pk.exe," "V.class" and a random .mof file. If nothing else, removing the .exe file should fix the virus for you. There was a lot that I couldn't find below, but that did the trick for me.

4. Open your task manager and kill the rogue Moneypak process, which will be a random string of CAPS letters and numbers.exe.

5. Run "regedit" to get your registry values folder and kill whatever you can find of these registry values:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[random].exe
HKEY_LOCAL_MACHINE\SOFTWARE\FBI Moneypak Virus
HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Policies\System ‘DisableRegistryTools’ = 0
HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system ‘EnableLUA’ = 0
HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Internet Settings ‘WarnOnHTTPSToHTTPRedirect’ = 0
HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Policies\System ‘DisableRegedit’= 0
HKEY_CURRENT_USER\Software\FBI Moneypak Virus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ‘Inspector’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FBI Moneypak Virus
HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Policies\System ‘DisableTaskMgr’ = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Inspector %AppData%\Protector-[rnd].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings\ID 4
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings\UID [rnd]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings\net [date of installation]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorAdmin 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorUser 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\Debugger svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\Debugger svchost.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0

To be safe, you should probably just delete all the files in your temp folder altogether. You don't need them, and you'll surely get the virus file that way (it might be invisible, and you'll surely get it that way)

That should eliminate the virus for you. I was running XP, did the majority of this stuff, and cleaned my computer of the virus completely.

A better version of this explanation can be found here, along with other ways of removing the virus here: How To Remove The FBI Moneypak Ransomware Virus - Fake FBI Malware Removal |

Edit: Somebody already listed this site. Whatever.
 
Top