How to get rid of MoneyPak ransomware infection

[lko]

My husband's user account has been taken over by the FBI-MoneyPak virus and is currently unusable. The other two accounts on the computer are password-protected (his isn't) and seem OK for now. I ran Windows Security Essentials and Malwarebytes scans from my account and they detected nothing. How can I get rid of this thing?

 

[Golden]

Hi Iko,

Please follow the instructions in this tutorial:

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html?filter

Regards,
Golden

 

[lko]

Thanks, Golden. I also received a suggestion from my IT staff at work to try HitMan Pro. It seems like one of these should do the trick.

 

[Golden]

No worries - let us know if you need more help.

Regards,
Golden

 

[Usedtobegood]

Hi.

Newbie here, I was infected with the Money Pak ransomware and using Hitman Pro, Malware Bytes, and other stuff I can't remember, I got rid of it EXCEPT when I logon I get a .dll error that it can't find C:\users\Mark\AppData\Local\Temp\0_0u_I.exe I have run Emsisoft, Malware Bytes, CCleaner and SUPERAntivirus but can't get rid of it. Any ideas?

I appreciate any ideas....I did Google "manual removal" and it references HKEY registry files but I cannot locate them in my registry? Thanks so much!

Mark

 

[black7]

FBI moneypak ransom

Hi,

I'm new here as well and currently struggling with the remnants of this virus.

Usedtobegood, the key is located in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

See this image:

Credits: Remove FBI MoneyPak Ransomware (Uninstall Guide)

Mine as gr5_qor_78.exe or something like that. The virus is gone now but my PC is slow as hell. Web browser crashes like five minutes or so. Could you guys tell me how to fix those errors and make my precious PC run faster again?

Any advice is much appreciated.

Simon

 

[Borg 386]

@Usedtobegood - Follow Goldens excellent advice in post #2

@Black7 - have a look at this link & try running SFC, the virus may have damaged some of your files.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Be sure to run it 3X as SFC doesn't always get everything the first/second time around

You may have to do a repair install.....

http://www.sevenforums.com/tutorials/3413-repair-install.html

And...there's always a chance you still have something on your system. Viruses are known for introducing other viruses.

 

[Usedtobegood]

@Black 7 I do not have a file similar to the one you show above.

I will try Goldens recommendations and report back.


Thanks!

 

[bigdog2626]

i got this virus myself what i did to stop the pop up of the fake fbi warning was deleted
C:\Users\bigdog2626\AppData\Local\Temp\glom0_og.exe
then removed a file from the startup folder called ctfmon.lnk
now im doing some scanning
i couldn't locate anything in my reg