Help With FBI Fake Virus - Malwarebytes Did Not Detect It

muskyx1

Member
Apr 20, 2005
151
1
81
So my PC was locked up by that Fake FBI MoneyPack virus. Rebooted into safe mode and ran Malwarebytes using the latest updates (it was already installed at the time of the infection). Problem now is that it did not detect it.

Would really appreciate some help.
 

SagaLore

Elite Member
Dec 18, 2001
24,036
21
81
Your safest action is to back your stuff up, and reformat the drive (including resetting the mbr).

If you visit risky sites, you should log in with a limited user account, use firefox with noscript, keep flash up to date, don't let the browser invoke adobe reader, and uninstall java if you don't need it.
 

muskyx1

Member
Apr 20, 2005
151
1
81
Weird, I have WinPatrol installed which detects unwanted start Up programs and asks you if it's OK. When I booted into safe mode, the latest start up program entry was userinit.exe. I ran both Malwarebytes and SuperAntiSpyware, and both found nothing. I booted up in regular mode and the Fake FBI screen popped up again. I booted back into safe mode and deactivated the userinit.exe start up program in WinPatrol, and again booted up normally. The fake FBI screen has yet to return. Is it possible that the userinit.exe is also fake and related to this FBI malware? Every 5 minutes or so, WinPatrol warns me that it's trying to re-join the start up programs again.
 
Last edited:

jmarti445

Senior member
Dec 16, 2003
299
0
71
I can easily assist, remove the virus from the startup folder and reboot windows, its a scareware and easy to remove.
 

Iron Woode

Elite Member
Super Moderator
Oct 10, 1999
31,309
12,824
136
Weird, I have WinPatrol installed which detects unwanted start Up programs and asks you if it's OK. When I booted into safe mode, the latest start up program entry was userinit.exe. I ran both Malwarebytes and SuperAntiSpyware, and both found nothing. I booted up in regular mode and the Fake FBI screen popped up again. I booted back into safe mode and deactivated the userinit.exe start up program in WinPatrol, and again booted up normally. The fake FBI screen has yet to return. Is it possible that the userinit.exe is also fake and related to this FBI malware? Every 5 minutes or so, WinPatrol warns me that it's trying to re-join the start up programs again.
MSCONFIG is your friend at this point. Disable everything in Start Up and then reboot and see what happens.

Malwarebytes isn't perfect. You can also try MSE.

I bet Hitman Pro can remove this infection.
 

MadScientist

Platinum Member
Jul 15, 2001
2,183
63
91
Last edited:

Danimal1209

Senior member
Nov 9, 2011
355
0
0
Using MSCONFIG > Startup Tab > the second column shows manufacturer. Usually, illegitimate software will say Unknown.
 

tcsenter

Lifer
Sep 7, 2001
18,947
572
126
Offline detection and cleaning FTW. I always keep an external enclosure handy, for PATA and SATA, in both 2.5" and 3.5". Anyone comes to me with one of these nasty rogue programs, drive automatically goes into an external enclosure and I run three proggies on it from another computer; MSSE, MalwareBytes, and then a top AV product like Norton, BitDefender, or Kaspersky. Sure, it takes a while, but its not like you must sit there watching the progress indicator.
 

NiceCold

Senior member
May 14, 2011
543
0
0
still no work?

use combo fix but i do not recommend as it is advance and can mess up your pc. use at your own risk.



ps. can watch porn in linux ubunto live cd catch virus?
 
Last edited:

smakme7757

Golden Member
Nov 20, 2010
1,487
1
81
Format.

Once you're infected there is no guarentee that you can completely scrub your system.

The aim of the game is to not get infected, once you are - Format!
 

MadScientist

Platinum Member
Jul 15, 2001
2,183
63
91
Almost 90% of the computer repair work I do now is cleaning infected computers. I totally agree that the only sure way of getting rid of a virus is to format and re-install the OS, but I also agree with John's statement from his website.

"Ok, I'm infected. What about a fresh Windows install? If you reinstall the operating system then you'll need to reinstall Windows updates (unless you have a slipstreamed copy), drivers, assorted software, tweaks, and all of your other peripherals which could easily take several hours. You'll then need to figure out how you were infected in the first place in order to prevent it from happening in the future. This is one of the main reasons that I rarely recommend a clean install. As long as you take the time to learn how to clean an infected system a fresh Windows install should be a last resort (unless you have a recent known good image of your drive)." http://www.elitekiller.com/malware.htm

The only time I format and reinstall the OS is when the OS is beyond repair, or the person has a good image of the drive. I have yet to encounter the latter.

Most people, no matter how many times I tell them to do so, never backup their important files, i.e., music, pictures, documents. An infected computer I worked on this week had 92GB of music files on it.

To answer smakme7757's question. Quoting John again: "The fact is that no single antivirus or antispyware application can successfully remove all malware circulating around the internet. It's not unusual to resort to an arsenal of security products in an attempt to ensure that everything has been properly removed."

If your computer is infected go to John's website, download his rogue removal kit, unzip it and read his Readme.pdf file.

To keep your computer from being infected again read and follow mechBgon's "How (and why) to secure your Windows PC" http://www.mechbgon.com/build/security2.html

And as John points out: "Most of all I can't stress enough how important it is to use common sense!"
 
Last edited:

SparkyJJO

Lifer
May 16, 2002
13,357
7
81
Awful lot of "nuke happy" people on here :p

It IS quite possible to fully disinfect a PC, and in most cases it isn't that hard to remove any remaining traces. I do it at work all the time. Aside from some people who just can't stay away from the dark corners of the internet I rarely have a reinfection.
 

JEDIYoda

Lifer
Jul 13, 2005
33,986
3,321
126
I can easily assist, remove the virus from the startup folder and reboot windows, its a scareware and easy to remove.
Please describe in detail what you are talking about?

Many experienced users have had issues with the FBI warning virus....
 

VirtualLarry

No Lifer
Aug 25, 2001
56,587
10,225
126
My friend just got this on his computer, while he was away for the day.

I asked him if he has Java installed, he said yes.

I told him it was probably a poisoned ad.
 

JEDIYoda

Lifer
Jul 13, 2005
33,986
3,321
126
My friend just got this on his computer, while he was away for the day.

I asked him if he has Java installed, he said yes.

I told him it was probably a poisoned ad.
Its quite a bit worse than a poisoned add.....if it is the FBI fake virus it locks your computer up......

Foe the people that have the real FBI virus its no laughing matter.....

I am sorry to inform you that you don`t get this virus by leaving and coming back to your computer...
 

VirtualLarry

No Lifer
Aug 25, 2001
56,587
10,225
126
I am sorry to inform you that you don`t get this virus by leaving and coming back to your computer...
You can, if you leave a web page open, that has rotating ads, that come from an ad server that is hacked or otherwise distributing "poisoned" ads, and your local computer system has a currently-exploitable vulnerability, like current versions of Java.
 

VirtualLarry

No Lifer
Aug 25, 2001
56,587
10,225
126
The sad irony is, if you've heard how this "FBI moneypak virus" works, the new "Six Strikes" system being implemented by ISPs around the country, in concert with demands from the RIAA/MPAA, is eerily similar.

Suddenly, whereever you browse on the internet, a page pops up, accusing you of something, and you either have to admit guilt, or pay a fine to contest it.

And your internet connection can be throttled, or cut off.

All without you actually doing something wrong.
 

JEDIYoda

Lifer
Jul 13, 2005
33,986
3,321
126
You can, if you leave a web page open, that has rotating ads, that come from an ad server that is hacked or otherwise distributing "poisoned" ads, and your local computer system has a currently-exploitable vulnerability, like current versions of Java.
I am sorry that will not happen if you are on a legitimate site and not some questionable porn site or other site.....
 

VirtualLarry

No Lifer
Aug 25, 2001
56,587
10,225
126
I am sorry that will not happen if you are on a legitimate site and not some questionable porn site or other site.....

Even legit site's ad servers have been compromised. LegitReviews was compromised a few months back, and even these forums have had their ad servers compromised at least once in the past. What you say, simply isn't true.