Fbi Moneypak Virus

Hi,

I am operating Windows 7, using the BitDefender Total Security 2012.

Last night, I received a Flash from the "FBI" with the moneypak scam I immediately shut my computer down and ran in safe mode. I have not gotten any further messages but I am sure the virus is still there as I didn't actually do anything to delete it. I have ran scans on Bitdefender today but how do I ensure that the virus is gone?

I have created a bdsys log, please let me know if it is ok to send you a PM with the link, and also steps I should take in the meantime.

Thank you for any help you can give me

Find more posts tagged with

Comments

rootkit

Hello

Welcome to the forums!

. Upload that file on

http://www.sendspace.com

http://www.mediafire.com

and send me a PM with the download link.

Take care.

rootkit

Hello

The log was sent to our labs, I will get back to you soon with the results.

Take care.

rootkit

Hello,

Thank you for your patience!

We have analyzed the scan log you have sent us. In order to remove all infected objects from your computer you need to perform the following steps:

. Restart the computer in Safe Mode With Networking;

[How to restart in SAFE MODE With Networking]

- Restart the computer;

- Press the "F8" key several times before Microsoft Windows begins to load; you need to press "F8" until you will be displayed a text menu;

- Select "SAFE MODE With Networking"

Download and install the software and then run it to clean your computer's registry and temporary files:

http://download.piriform.com/ccsetup322.exe

http://www.piriform.com/docs/ccleaner/usin...gistry-cleaning

Once the cleaning is complete it's recommended to restart your computer(again in Safe Mode).

If you have a registry cleaner already installed, you can use that one.

Open Windows Registry Editor

[how to open Windows Registry editor]

http://techie-buzz.com/how-to/how-to-use-regedit.html

and locate the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

and delete all the subkeys.

[how to CLEAN REGISTRY ENTRIES]

Warning: Please make sure to follow the exact steps detailed below and to delete the exact keys/values detailed. Altering another section of your Windows Registry may render your system unusable.

In order to clean your Windows registry section please follow the steps below:

- click "Start" and then select "Run..."; (on Windows Vista/7 type "run" in the "Start Search" box and hit Enter)

- type "regedit" in the run edit box and hit "OK" to open the Registry Editor;

- browse to the registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

- delete all the keys under this key there should be a lot of .exe entries

- after you delete the exact key(s)/value(s) written above you may close Registry Editor.

The second key is only for 64 bits systems.

[How to check if your computer is a 32bits or 64bits]

Please right click on the icon MY COMPUTER / COMPUTER located on your desktop and go to PROPERTIES. There, under system information and computer information you will see a notification about your computer being a 64bits. If none ( nor one about 32bits ) then your computer is a 32bits one.

Note:

- if using Vista or 7 you will see if your computer is either 32bits or 64bits.

- if using XP you will only see it mentioned ONLY if your computer is a 64bits.

If the situation persists or you require further assistance please do not hesitate to contact us.

Have a great day!

Alan Kam

I too have the same problem. I am running Windows Vista. I am using Bit Defender Total Security 2013.

Help!!!

rootkit

Hello

In order to be able to further investigate the reported situation we need a bit more information from your computer as follows:

. A BDSYS log;

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Upload that file on

http://www.sendspace.com

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2013]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

We will get back to you as soon as the analysis is complete.

Have a nice day.

rootkit

I have received the files and forward them to the labs.

As soon as I receive the results, I will post here how to remove the malware.

Thank you!

rootkit

Hello

Thank you for your patience.

We have analyzed the scan log you have sent us. In order to remove all infected objects from your computer you need to perform the following steps:

. Restart the computer in Safe Mode With Networking;

[How to restart in SAFE MODE With Networking]

- Restart the computer;

- Press the "F8" key several times before Microsoft Windows begins to load; you need to press "F8" until you will be displayed a text menu;

- Select "SAFE MODE With Networking"

. Display hidden objects in Windows (how to information is written bellow);

[how to DISPLAY HIDDEN OBJECTS]

- go to your "Control Panel" and open "Folder Options";

- then go to the "View" tab and perform the changes listed below:

* check "Display contents of system folders"

* check "Show hidden files and folders"

* uncheck "Hide file extensions for known file types"

* uncheck "Hide protected operating system files"

- click "Apply" and then "OK" to exit.

NOTE: On Microsoft Windows Vista/7 you will apply the same steps except for selecting "Display contents of system folders".

For more information you can read the following article:

http://kb.bitdefender.com/KB354-en--Reveal...em-folders.html

. Locate the suspect/infected file(s):

c:\users\alan\appdata\local\microsoft\windows\1964\tapimigplugin.exe

After you do this, please delete that/those file(s).

Download and install the software and then run it to clean your computer's registry and temporary files:

http://download.piriform.com/ccsetup324.exe

http://www.piriform.com/docs/ccleaner/usin...gistry-cleaning

Once the cleaning is complete it's recommended to restart your computer.

If you have a registry cleaner already installed, you can use that one.

If the situation persists or you require further assistance please do not hesitate to contact us.

Have a great day!