Help: FBI Scam Virus

[strangeorange]

My dad has somehow gotten a FBI scam virus on his computer asking for money. I did some searching here on the forum and didn't find too much information so I did everything I thought needed to be done from the Help FAQ post. Attached are the logs. I want to add that after I ran everything (I had to do it in safe mode because Windows will not work otherwise) and tried to reboot, the computer just has a black screen now once it tries to log into Windows and then nothing happens.

[strangeorange]

More logs! Please help I've been working at it for two hours and I'm kind of a newb at coming to a forum for help. I've never had this big of an issue with a virus before, fortunately.

[Pondus]

removal specialists are notified. it may take hours before one arrive so be patient

[mchain]

+1 

Whoever comes in to assist will know what to do as they are fully certified and qualified.  Since you now have an issue with entering normal user mode?, but still can work in Safe Mode?, be assured that person will take that into account.

Please be patient.  Whatever you do, do not pay the monies asked for!  Likely result is the money will vanish and no fix is forthcoming from the malware creator of this rogue software.

EDIT:  fixed typos

[essexboy]

Hi, OK these two programmes will run from safe mode.  On completion boot to normal mode and let me know if you get to the desktop

• Download RogueKiller  and save it on your desktop.
   
  NOTE: If using IE8 or better Smartscreen Filter will need to be disabled
  
  
• Quit all programs
• Start RogueKiller.exe.
  
• Wait until Prescan has finished ... 
•     Click on Scan

   
 

• Wait for the end of the scan. 
• The report has been created on the desktop. 
• Click on the Delete button.

     

• The report has been created on the desktop.

• Next click on the ShortcutsFix   
  
  
• The report has been created on the desktop.

Please post:    All RKreport.txt text files located on your desktop.

THEN

 Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
O4 - HKU\S-1-5-21-4223141925-2066639928-2696967503-1001..\Run: [Task Scheduler] C:\Users\Joe\AppData\Roaming\Task Scheduler\Task Scheduler.exe (?????????? ??????????)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Joe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Task Scheduler.lnk = C:\Users\Joe\AppData\Roaming\Task Scheduler\Task Scheduler.exe (?????????? ??????????)

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[strangeorange]

Thank you so much for helping me. When I get home from work I will try this immediately and update you on how it went. Thanks again!

[strangeorange]

I did everything as instructed and when the computer rebooted after OTL I didn't F8 fast enough to get it into safe mode. Windows started fine but I disabled the wireless as quickly as I could to run the last OTL step. I saved everything to a flash drive to get it to my computer so I could post online but I see, unfortunately, that for some reason the rogue killer document didn't save for some reason. If I re-run it, will it give you what you need? Attached are the OTL logs. Again, really sorry about the RK log.

I'd also like to add I'm just a reply or two away from the Wayne and Garth "we're not worthy" bow-down.

[essexboy]

OTL now looks OK ..  When you get to the normal desktop how does it appear, normal ?

[strangeorange]

Yes, everything appeared normal and was working without lag on opening programs.

[strangeorange]

Thank you, thank you very much!

[essexboy]

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?Keep safe  :wave:

[Kilia]

essexboy said: "If you use on-line banking then as an added layer of protection install Trusteer Rapport."

I sure need a program like this, but when I went to the URL you gave, I could not find where to download the program?
Many thanks..

[polonus]

Also Netcraft Anti-Phishing extension is a great help,

polonus

[essexboy]

The buggers have changed the page...  Here is the new one, you need your e-mail address and they will then mail the download link http://www.trusteer.com/download-trusteer-rapport

[strangeorange]

I ran OTL twice as requested. It had me restart the computer twice as well. I verified the Hidden Files/Folders were marked to not show. I then downloaded all the mentioned product. I'm still waiting to hear back in e-mail for the Trustee Rapport. It will be perfect for him because not only does he bank online but he also does some small stock trading during the day. He's a disabled senior and that's where he finds his day-to-day fun. I removed the free AVG he had on his laptop and replaced it with my paid subscription of Avast with my license so he will be covered for the next 4.5 years if he keeps on top of his automatic updates AND IS MORE CAREFUL with all those couponing web sites he goes to. Then I did the same to my mother's laptop (she was running a Comcast-provided version of Norton, which I uninstalled after installing Avast). I'll add those programs to her system and run them for my parents weekly/monthly per your recommendation.

One more question -- the wireless that my dad runs off of is a Belkin 54g router that is password protected. It is set on WPAP2, I believe. Is it possible that this virus has gotten to other computers on the network but hasn't shown its face yet? I remember how no scanner was detecting the virus on my dad's computer when it was initially attacked, so I worry that it hasn't been detected on any other system but hasn't corrupted enough files yet -- or is working in a hidden way to send information that is being passed online. Is that an irrational fear?

And here is the Wayne and Garth bow-down to all of you, but mostly you essexboy!