Upon starting the computer, instead of my regular desktop, a message, supposedly issued from the FBI or any other Police Corps, warns of illegal activity detected on my PC and payment of a fine is required in order to retrieve full access. The message looks like this:
The cause of this is trojan Trj/Ransom, also known as the FBI MoneyPak/Mandiant/Metropolitan Police Virus/Cyber Security/Police Ukash/PCeU or Police Virus, so, please, do not follow the instructions indicated on the screen!
Before you begin
- You need a computer with Windows OS that can boot up.
- You need a USB drive.
- It is advisable to print the instructions beforehand.
Step 1: USB Download and creation
- Go to a computer with Windows OS that can boot up.
- Download and save the PandaCloudCleanerUSB.exe installation file by clicking the Download button. We advise you to save it to your desktop.
- Insert a USB drive in the computer.
- Double-click the file you have just downloaded and select Start.
- Follow the steps of the rescue USB wizard and wait until the download is completed.
- Once the installation is finished, a window will be shown informing that the USB has been correctly created.
Step 2: Scan and Disinfection
- Insert the USB in the USB port of the infected computer and start the PC.
Most computers will automatically boot up from the USB unit. Otherwise, you will need to change the boot sequence in the BIOS of your PC.
For further information, please refer to article How to change the boot sequence of my PC.
- Once the computer starts, the Panda Cloud Cleaner installation wizard will automatically launch.
Read the license agreement and click Enter to accept it.
- The wizard will prepare the computer so that, next time the computer is restarted, Panda Cloud Cleaner will scan and disinfect all the viruses.
- Remove the USB drive when the wizard displays the message Please, remove the usb.
- Press any key when you see a message saying Analysis can now start!.
- The computer will be restarted.
- Once started, you will see Panda Cloud Cleaner. Click Accept and Scan for the virus scan and disinfection to begin.
Note that, due the advanced boot mode used, you won't be able to interact with the PC until the scan finishes.