Below are the instructions to identify and solve the incident.
When I restart my computer, instead of my regular desktop, a message, supposedly issued from the FBI or any other Police Corps, warns of illegal activity detected on my PC. What’s more, payment of a fine is required in order to retrieve full access.
If you are experiencing these symptoms, you have been infected by Trj/Ransom, also known as the FBI MoneyPak or Police Virus.
In order to fully disinfect Trj/Ransom.ab, you need to create and scan your computer with a rescue disk. Please follow the steps below:
Step 1 - Download PandaRescueDisk.iso
Download and save the PandaRescueDisk tool from a virus-free computer.
Step 2 - Boot the infected computer with PandaRescueDisk.iso
You have 2 options to boot the PC with the PandaRescueDisk.iso, either from a CD or from a USB stick:
Booting from a CD-ROM
- Once you have downloaded the file, open your CD burning software program.
- Burn the PandaRescueDisk.iso image with your usual CD burning application.
- Remember of course that each application has its own instructions.
- Once you have created the CD, start the computer from your CD-ROM drive and check whether your system is infected.
Booting from a USB stick
- Download UNetbootin.
- Save the file to your hard disk. You can create a folder called C:\panda to save it.
- Insert an empty USB stick into a USB port.
- Double click unetbootin-windows-xxx.exe, where xxx match the UNetbootin version number.
- Select the option Diskimage, click the … button, select the PandaRescueDisk.iso file, and click OK.
- Wait until the process is completed.
- Once the bootable USB stick has been created, start the computer from the USB stick.
NOTE: If you have problems upon rebooting from the CD-ROM drive, refer to How to boot from a CD-ROM.
Step 3- Scan with Panda RescueDisk
- Once you have started the system from the CD USB, you will see the Panda RescueDisk screen. Select the Live option and press Enter for the scanning and disinfection process to begin.
- When the process is finished, remove the disk and press Enter to restart the computer.
- Open your antivirus program and carry out a full scan of the computer in order to verify the full disinfection of Trj/Ransom.ab.
Running PandaRescueDisk will disable all items that are loaded automatically at Windows startup except for the antivirus. To enable any of these items again, follow these steps:
- Click the Windows Start button, select Run, type msconfig and press Enter.
- Click the Startup tab.
- Select the programs you want to be loaded at Windows startup.
Step 4 - Prevent future infections
These types of virus usually exploit system or software vulnerabilities. In order to prevent future infections, don't forget to take the following cautionary measures:
- Avoid visiting unsafe websites. You can use the Internet safely, for example using a browser sandbox such as Panda Safe Browser.
- Disable Java from your browser. For further information, refer to how to configure Java and how to disable Java.
- Always have your Operating System up-to-date, for instance, by carrying out Windows updates.
- Never open emails coming from unknown senders, they could contain virus.