Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

help with fbi moneypak ransomware


  • This topic is locked This topic is locked
5 replies to this topic

#1 timb243

timb243

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:47 PM

Posted 06 February 2013 - 05:21 PM

I am infected with fbi moneypack ransomware. I can not set my computer to earlier check point. what do I do please help.

BC AdBot (Login to Remove)

 


#2 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:04:47 PM

Posted 06 February 2013 - 07:05 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Please take note:

  • If you have since resolved the original problem you were having, we would appreciate you letting us know.
  • If you are unable to create a log because your computer cannot start up successfully please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • If you are unable to perform the steps we have recommended please try one more time and if unsuccessful alert us of such and we will design an alternate means of obtaining the necessary information.
  • If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.
  • If you have already posted a DDS log, please do so again, as your situation may have changed.
  • Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.



Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


Note:
If you are unable to run a Gmer scan due the fact you are running a 64bit machine please run the following tool and post its log.

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.



Thanks and again sorry for the delay.

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#3 timb243

timb243
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:47 PM

Posted 06 February 2013 - 07:59 PM

downloaded and ran dds. used defogger to disable cd emulation. downloaded awsmbr and scanned but it seemed to get stuck b/c of a corrtup file. i copied log anyway. can operate computer in safe mode but have to use other computer to download info and save to flash drive.

aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software
Run date: 2013-02-06 19:41:30
-----------------------------
19:41:30.630 OS Version: Windows 6.0.6001 Service Pack 1
19:41:30.630 Number of processors: 2 586 0xF06
19:41:30.630 ComputerName: JON-PC UserName: jon
19:41:31.660 Initialize success
19:41:53.500 AVAST engine download error: 0
19:41:53.500 AVAST engine defs: 13020300
19:42:02.844 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2
19:42:02.844 Disk 0 Vendor: WDC_WD32 12.0 Size: 305245MB BusType: 3
19:42:02.876 Disk 0 MBR read successfully
19:42:02.876 Disk 0 MBR scan
19:42:02.891 Disk 0 Windows VISTA default MBR code
19:42:02.907 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
19:42:02.922 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304
19:42:02.938 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 294956 MB offset 21069824
19:42:02.954 Disk 0 scanning sectors +625139712
19:42:03.094 Disk 0 scanning C:\Windows\system32\drivers
19:42:16.900 Service scanning
19:42:32.828 Modules scanning
19:42:35.963 Disk 0 trace - called modules:
19:42:36.010 ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys iastor.sys hal.dll
19:42:36.026 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85fd6438]
19:42:36.026 3 CLASSPNP.SYS[887bc745] -> nt!IofCallDriver -> [0x85fd6d00]
19:42:36.041 5 PCTCore.sys[830db099] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-2[0x85b12030]
19:42:37.071 AVAST engine scan C:\Windows
19:42:53.186 AVAST engine scan C:\Windows\system32
19:46:17.920 AVAST engine scan C:\Windows\system32\drivers
19:47:00.992 AVAST engine scan C:\Users\jon
19:50:15.414 Disk 0 MBR has been saved successfully to "G:\MBR.dat"
19:50:15.461 The log file has been saved successfully to "G:\aswMBR.txt"


aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software
Run date: 2013-02-06 19:41:30
-----------------------------
19:41:30.630 OS Version: Windows 6.0.6001 Service Pack 1
19:41:30.630 Number of processors: 2 586 0xF06
19:41:30.630 ComputerName: JON-PC UserName: jon
19:41:31.660 Initialize success
19:41:53.500 AVAST engine download error: 0
19:41:53.500 AVAST engine defs: 13020300
19:42:02.844 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2
19:42:02.844 Disk 0 Vendor: WDC_WD32 12.0 Size: 305245MB BusType: 3
19:42:02.876 Disk 0 MBR read successfully
19:42:02.876 Disk 0 MBR scan
19:42:02.891 Disk 0 Windows VISTA default MBR code
19:42:02.907 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
19:42:02.922 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304
19:42:02.938 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 294956 MB offset 21069824
19:42:02.954 Disk 0 scanning sectors +625139712
19:42:03.094 Disk 0 scanning C:\Windows\system32\drivers
19:42:16.900 Service scanning
19:42:32.828 Modules scanning
19:42:35.963 Disk 0 trace - called modules:
19:42:36.010 ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys iastor.sys hal.dll
19:42:36.026 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85fd6438]
19:42:36.026 3 CLASSPNP.SYS[887bc745] -> nt!IofCallDriver -> [0x85fd6d00]
19:42:36.041 5 PCTCore.sys[830db099] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-2[0x85b12030]
19:42:37.071 AVAST engine scan C:\Windows
19:42:53.186 AVAST engine scan C:\Windows\system32
19:46:17.920 AVAST engine scan C:\Windows\system32\drivers
19:47:00.992 AVAST engine scan C:\Users\jon
19:50:15.414 Disk 0 MBR has been saved successfully to "G:\MBR.dat"
19:50:15.461 The log file has been saved successfully to "G:\aswMBR.txt"
19:53:07.389 Disk 0 MBR has been saved successfully to "G:\MBR.dat"
19:53:07.420 The log file has been saved successfully to "G:\aswMBR.txt"

#4 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:04:47 PM

Posted 06 February 2013 - 11:29 PM

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt[*]In the command window type in notepad and press Enter.[*]The notepad opens. Under File menu select Open.[*]Select "Computer" and find your flash drive letter and close the notepad.[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.[*]The tool will start to run.[*]When the tool opens click Yes to disclaimer.[*]Press Scan button.[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.[/list]

Edited by fireman4it, 06 February 2013 - 11:30 PM.

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#5 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:04:47 PM

Posted 08 February 2013 - 10:52 PM

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 3-5 days the topic will need to be closed.

Thanks for understanding smile.png

With Regards,
fireman4it

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#6 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:04:47 PM

Posted 11 February 2013 - 08:27 PM

Hello.

There had been no reply from the topic starter in 5 days. Due to inactivity, this topic is now closed.
If you are the topic starter and need this topic reopened, send me a message.

Everyone else, please begin a new topic.

With Regards,
fireman4it

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users