First of all I have noticed there are several versions from the following lock screen pictures:
Version 3: Thanks to Narenxp found in post number 5 (http://www.bleepingcomputer.com/forums/topic469935.html/page__view__findpost__p__2853265). I do not have a sample of this one yet
Version 4: This is the picture from the virus removal section here on BC (http://www.bleepingcomputer.com/virus-removal/remove-fbi-monkeypak-ransomware). I do not have a sample of this one yet
I am still looking for other versions that are out there.
Second of all I have noticed the first version (http://www.bleepingcomputer.com/virus-removal/remove-fbi-monkeypak-ransomware) only locks the screen if the computer is connected to the internet. Once the internet is disconnected the user is able to see the desktop screen. The second version locks the screen in both normal and safe mode. Version 3 and 4 I do not have a sample yet.
Thrid of all I have noticed that the removal of the first version is very easy to do by following the virus removal link here on BC (http://www.bleepingcomputer.com/virus-removal/remove-fbi-monkeypak-ransomware). Where as the second version uses several other Trojans and Rootkits to make it very difficult to remove. On both versions I have been able to remove but the second one took more time to remove. Version 3 and 4 I do not have a sample yet.
I am still reverse engineering the samples I have so more will come soon.
I am also aware of a other versions completely different than the ones above but I do not have a sample of it yet. Soon as I can get my hands on the other versions I will post my findings of it here as well.
#1 Edit cause I needed to remove my IP and Hostname from picture of version 2 ~ herg62123
#2 Edit to include a post link that Narenxp posted in post number 5 ~ herg62123
#3 Edit to include a copy of the picture posted in the virus removal section ~ herg62123
Edited by herg62123, 27 September 2012 - 08:48 PM.
Moved to AV forum. ~ OB