What is the FBI virus?
The FBI virus (FBI Moneypak virus, FBI computer lock, FBI browser lock, etc.) is a dangerous malware categorized as ransomware we discovered in 2012 that infects both Mac and Windows Operating Systems. Cyber criminals use this malware in order to attempt to disguise themselves as the FBI so they can scare victims into paying an unnecessary fine. The FBI virus utilizes Trojan horses (Trojan.Ransomlock.R, reveton, etc.) or script placed on a website in order to lock computer systems and/or lock internet browsers such as Chrome, Firefox, and Internet Explorer in place. Once a browser or computer is locked by the FBI virus, a user is presented with a page that claims a computer user violated the law and now the computer owner must pay a fine in order to unlock their browser or computer. Some of the FBI computer viruses may claim to encrypt a computer’s files and hold them hostage until a fine is paid.
RansomLock Trojan The FBI virus practices social engineering by attempting to scare (persuade) unsuspecting victims into paying an unnecessary fine. The ransomware infection does this by making fraudulent claims on the browser-lock or screen-lock window that states the computer has been involved in illegal activity (downloaded or distributed copyrighted material or viewed child pornography, etc.) and demands a penalty fine of $100, $200, $300, or more to be paid in order to unlock the computer system (or browser) within the allotted time of 48 to 72 hours by use of Moneypak cards and other credit services (REloadit virus, Ultimate Game Card Virus, Ukash Virus). The FBI Moneypak ransomware virus also states on the fake FBI screen that the computer owner may see jail time or face other consequences if the unnecessary fine is not paid in time.
Please note, this is dangerous malware called ransomware that is in no way associated with the government of the United States. The claims made by the FBI virus are entirely fraudulent and meant to scam and harm it’s vicgims. If your computer or internet browser is locked by a scren claiming to be from the FBI you are not in trouble with the FBI. Paying the fine using Ukash vouchers, Moneypak cards, and all other credit services will not fix this malware infection. Using an activation number to remove the FBI virus will likely initiate a response by the malware which leads to further complications.
*Logging in as a different user
In most cases if there are multiple accounts on your Window’s system you will be able to access the other accounts that are not infected without conflict. If a second account has administrator rights, in some cases you will be able to remove the infection using this user. To learn more please visit the bottom of this page and view relating forum topics.
Deny flash option
The FBI Moneypak virus utilizes flash and in some cases, disabling (denying) flash can “freeze” the FBI Moneypak virus (suspend), which allows proper removal methods to be performed. Please note this is not a necessity, nor will this remove the virus. This is only an option for specific individual infections. *This may be skipped. 1. To disable (deny) flash visit: Deny Flash 2. Select the “Deny” radio option 3. Proceed to a removal option: Anti malware software scan and removal or system restore.
What does denying flash do?
If you select Deny, the malicious application does not have access to your camera or your microphone. The application will continue running, but may not function as intended. Alternately, the application may inform you that it can’t continue unless you allow access, in which case you can either allow access or close the application.
1. Malware Removal Software
Use these directions to automatically remove the FBI virus using Malwarebytes Anti-Malware software. Additional FBI virus removal software and tools are detailed below, including AVG and Symantec Norton.
1. We highly recommend writing down the toll free number below in case you run into any issues or problems while following the instructions. Our techs will kindly assist you with any problems.
1-855-887-2337 if you need help give us a call
2. Install the free or full version of Malwarebytes Anti-Malware
Border Ten
Malwarebytes’ Anti-Malware Green Arrow Bullet Editor’s Choice
Malwarebytes Anti-Malware software
$24.95 USD (1 Year – 3 PCs) / FREE
Latest versions: Malwarebytes’ Anti-Malware Premium, Malwarebytes’ Anti-Malware Free Release date: 2014
Purchase Malwarebytes Premium Free Download
Border Ten
3. Open the Malwarebytes’ program. On the home ‘Scanner’ tab, run a Full System Scan by selecting the Perform full scan radio option followed by clicking the Scan button (pictured below). A Full Scan may take over 1 hour. A quick scan may take around 6 minutes; however, will not find as many malicious files as a full scan.
Malwarebytes Perform Full Scan
4. Malwarebytes will automatically detect malware on the computer system and once the scan is complete Malwarebytes will display the malicious results. Make sure to finish the scan by selecting the malicious file and clicking the Remove Selected button.
Purchase AVG Free Download
Border Ten
Avira Antivirus
Buy Avira Antivirus
$36.99 USD (1 Year) / FREE
Latest versions: Premium 2014, Avira Free Antivirus Release date: 2014
PPurchase Avira Antivirus Free Download
Border Ten Other: Microsoft Defender (free), Microsoft Security Essentials (free)
2. Manual Removal (Advanced)
If this option does not help you locate the malicious files, skip it. Do not be alarmed if some files described below are not found in your particular infection, such as the ctfmon file.
We are going to enter your computers App Data (Application Data), which is a hidden folder with hidden files. To learn how to show hidden files click here.
1. Open Windows Start Menu and type %appdata% into the search field and press Enter. %Appdata% 2. Navigate to: Microsoft\Windows\Start Menu\Programs\Startup App Data Start Menu 3. Remove ctfmon (ctfmon.lnk if in dos) – this is what’s calling the virus on start up. This is not ctfmon.exe.
4. Open Windows Start Menu and type %userprofile% into the search field and press enter. Userprofile 5. Navigate to: Appdata\Local\Temp 6. Remove rool0_pk.exe rool0_pk.exe 7.Remove [random].mof file 8. Remove V.class
The virus files may have names other than “rool0_pk.exe” but file names should appear similar with the same style of markup. There may also be 2 files, 1 being a .mof file. Removing the .exe file will fix FBI Moneypak. The class file uses a java vulnerability to install the virus and removal of V.class is done for safe measure.
Windows Start Menu Rstrui.exe Restore
1. Access Windows Start menu 2. Type rstrui.exe into the search field and press Enter 3. Follow instructions in Window’s Restore Wizard
Start Menu Restore
Start Menu System RestoreStandard directions to quickly access Window’s System Restore Wizard.
1. Access Windows Start menu and click All Programs. 2. Click and open Accessories, click System Tools, and then click System Restore. If you are prompted for an administrator password or confirmation, type the password or provide confirmation. 3. Follow the simple instructions to Restore your computer to a date and time before infection.
Safe Mode With Command Prompt Restore
If you can not access Window’s desktop, this is the suggested step. If it is difficult to start windows in safe mode; if Windows’s brings up a black screen, with “safe mode” in the four corners – Move your cursor to the lower left corner, where the Search box is usually visible in Windows Start Menu and it will come up, including the “Run” box.
1. Restart/reboot your computer system. Unplug if necessary. 2. Enter your computer in “safe mode with command prompt”. To properly enter safe mode, repeatedly press F8 upon the opening of the boot menu.
Safe mode with command prompt
3. Once the Command Prompt appears you only have few seconds to type “explorer” and hit Enter. If you fail to do so within 2-3 seconds, the FBI MoneyPak ransomware virus will not allow you to type anymore.
Comand Prompt Type Explorer
4. Once Windows Explorer shows up browse to: •Win XP: C:\windows\system32\restore\rstrui.exe and press Enter •Win Vista/Seven: C:\windows\system32\rstrui.exe and press Enter
System32 rstrui 5. Follow all steps to restore or recover your computer system to an earlier time and date (restore point), before infection. Restore system files and settings More System Restore Links: ••
4. Safe Mode With Networking
For users needing access to the Internet or the network they’re connected to. This mode is helpful for when you need to be in Safe Mode to troubleshoot but also need access to the Internet for updates, drivers, removal software, or other files to help troubleshoot your issue.
•This mode will also bypass any issues where Antivirus or Anti Malare applications have been affected/malfunctioning because of the FBI Moneypak infection’s progression.
The plan with this option is to enter your computer in “safe mode with network” and install anti-malware software. Proceed to scan, and remove malicious files.
1. Reboot your computer in “Safe Mode with Networking”. As the computer is booting (when it reaches the manufacture’s logo) tap and hold the “F8 key” continuously to reach the correct menu. On the Advanced Boot Options screen, use your keyboard to navigate to “Safe Mode with Networking” and press Enter. Shown below.
Safe mode with networking •Make sure to log into an account with administrator rights.
The screen may appear black with the words “safe mode” in all four corners. Click your mouse where windows start menu is to bring up necessary browsing. safe mode 4 corners
2. There are a few different things you can do… •Pull-up the Start menu, enter All Programs and access the StartUp folder. •Remove “ctfmon” link (or similar).
This seems to be an easy step in removing the FBI virus for many users. If you are interested in learning about ctfmon.exe please click here.
Now, move on to the next steps (which is not a necessity if you removed the file above but provides separate options for troubleshooting).
3. If you still can’t access the Internet after restarting in safe mode, try resetting your Internet Explorer proxy settings. These 2 separate options and following steps will reset the proxy settings in the Windows registry so that you can access the Internet again.
How To Reset Internet Explorer Proxy Settings •Option 1
In Windows 7 click the Start button. In the search box type run and in the list of results click Run.
In Windows Vista click the Start button and then click Run.
In Windows XP click Start and then click Run.
Copy and paste or type the following text in the Open box in the Run dialog box and click OK: reg add “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /v ProxyEnable /t REG_DWORD /d 0 /f
In Windows 7 click the Start button. In the search box type run and in the list of results click Run.
In Windows Vista click the Start button and then click Run.
In Windows XP click Start and then click Run.
Copy and paste or type the following text in the Open box in the Run dialog box and click OK: reg delete “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /v ProxyServer /f
Restart Internet Explorer and then follow the steps listed previously to run the scanner •Option 2
Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.
LAN Tab
4. It is now recommended to download Malwarebytes (free or paid version) and run a full system scan to remove FBI Moneypak malware from your computer if you do not have this application on your system.
5. Flash Drive Option
1.Turn off your computer system and Unplug your internet connection 2.Turn the machine back on (In some cases the virus can only open if your machine is plugged into the internet) 3.On another (clean) computer, download Malwarebytes or your preferred removal program and load the Mbam-Setup.exe (or similar) file onto the flash drive 4.Remove the flash drive from the clean computer and insert it into the affected machine, proceed to install Malwarebytes (etc) using the setup file located on the flash drive. 5.Run a full system scan, Malwarebytes will find and eradicate malicious files 6.Restart your machine
6. Optical CD-R Option
1.Place a blank CD-R into your CDROM drive 2.Download and place Microsoft Defender or your prefered removal program onto the blank CD-R 3.Restart your computer and boot from CD
“You may need an old school keyboard (not the USB, but the PC connector type) since the virus delays the USB startup. The Defender will clean your PC in totality. This virus is somehow complex, but is no match for Windows Defender. After the scan is complete, run again a full scan without a restart.”
7. Slave Hard Disk Drive Option
If you are having complications with Anti-Malware software a suggestion would be to slave your HDD, then proceed to scan. You will need a second operating computer and tools to remove your hard drive. *Please note this may be difficult for some users and there are other options to scan your hard drive during complications. This is a common practice for local computer technicians. 1.Remove the Hard Disk Drive from your computer. 2.On the circuit board side of your HDD set the drive to “slave”. 3.Connect the slave drive to an unaffected computer. 4.Scan the slave drive, and proceed to remove any malware on the drive. Make sure to scan each user account. 5.Reconnect the HDD to your original computer.
FBI virus screen shots and updates
There are several different variants of malware or FBI computer viruses that infects computer systems primarily disguised as the FBI. These different versions of the FBI cryptovirus will also display different fake FBI lock-screens. Though the FBI screens, claims, notifications, and warnings may be different, the removal steps to remove FBI viruses are essentially identical.
FBI Virus
The first version (above) is the most popular form of the FBI virus and demands a payment of $100 while the second version (below) demands $200.
FBI Moneypak
New Variant: FBI Online Agent Virus
FBI Online Agent Virus This is the messasge displayed by the new FBI Online Agent virus: FBI Online Agent has blocked your computer for security reason The work of your computer has been suspended on the grounds of unauthorized cyberactivity. Described below are possible violates, you have made: Article 274 – Copyright A fine or imprisonment for the term of up to 4 years. (The use or sharing of copyrighted files – movies, software) Article 183 – Pornography A fine or imprisonment for the term of up to 2 years. (The use or distribution of pornographic files). Article 184 – Pornography involving children (under 18 years) Imprisonment for the term of up to 15 years. (The use of distribution of pornographic files) (…)
New Variant: FBI Ultimate Game Card
There is a new variant of FBI malware which uses the “Ultimate Game Card pay by cash” payment system. This new Ultimate Game Card variant of FBI ransomware does not typically hijack webcam settings. •Click to view screenshot •Click to view Ultimate Game Card article
New Variant: Department of Justice – FBI Black Screen of Death Virus •Click to view screenshot •Click to view FBI Black Screen of Death virus article
New Variant: FBI Audio Virus
A new version of the FBI virus has been infecting computers without a FBI warning screen (black screen), only streaming audio stating the computer is locked by the FBI, etc. This version of the FBI virus is often referred to as the FBI song, the FBI audio virus, the Black screen virus, Black audio virus, FBI sound virus, and other loose references.
New Variant: FBI Cybercrime Division Virus
FBI Cyber Crime Division Virus Removal This new version of the FBI virus is referred to as the $300 FBI virus, FBI Cybercrime division virus, and International Cyber Security Protection Alliance virus. •Click to view FBI Cybercrime Division article
New Variant: Computer Crime and Intellectual Property Section virus
Computer Crime and Intellectual Property Section virus removal •Click to view FComputer Crime and Intellectual Property Section article
FBI Moneypak virus: Symptoms and dangers
Detailed below are procedures, symptoms, tactics, and dangers of the FBI virus. •The FBI virus causes the computer system to lock, not allowing the user to access the computer’s desktop, nor access the internet. •Once the computer is infected the user is directed to a fraudulent FBI screen. •The fraudulent FBI page/screen/website (as with most ransomware) details an alert message that reads: “Attention! Your PC is blocked due to at least one of the reasons specified below”:
You have been violating Copyright and related rights Law (Video, Music,Software) and illegally using or distributing copyrighted content, thus infringing Article I, Section 8, clause 8, also known as the Copyright of the Criminal Code of United States of America. If it is PCEU Virus then this is thus infringing Article 128 of the criminal code of Great Britain.
The ransomware details that you have been viewing or distributing prohibited pornographic content (Child Pornography/Zoofilia). Thus violating article 202 of the Criminal Code of United States of America. Article 202 of the criminal provides for deprivation of liberty for two or twelve yours.
Illegal access to computer data has been initiated from your PC,or you have been. Article 210 (it is 208 for PCEU Virus) of the Criminal Code provides for a fine of up to $100,000 and/or a deprivation of liberty for four to nine years.
Fines may only be paid within 72 hours after the infringement. As soon as 72 hours elapse, the possibility to pay the fine expires, and a criminal case is initiated against you authomatically within the next 72 hours! (Sometimes it shows you within 2 hours or 48 hours).
Web cam control
FBI Moneypak Video Recording
The FBI virus and ransomware alike often control the web cameras (webcam, web cam) of computer systems they infect. When the computer user is taken to the fake FBI drive-by-download website (or the screen simply pops up), a streaming video is displayed from the users connected webcam. The ransomware virus screen or page may display the webcam as “recording”. If you do not have a web cam connected the video screen will appear blank and will still show as recording. The FBI virus and alike malware are capable of recording your through your webcam and connected audio interfaces, such as microphones and audio production equipment.
Antivirus/Anti-Malware Software malfunction/termination
The FBI Moneypak virus may cause Antivirus software to malfunction. Anti Malware and Antivirus programs can be used to scan and remove the FBI Moneypak virus but in many scenarios the infection has progressed far enough to disable removal software. There are steps around this, such as entering your system in safe mode or restoring your computer, unplugging from the internet, denying flash, using the optical disk drive option, safe mode with networking, or slaving your HDD. safemode with command prompt fbi moneypak This Facebook user removed FBI Moneypak malware by entering Windows in “Safe Mode With Command Prompt” and performing a restore. Instructions to perform system restores using safe mode are outlined above.
Telephone Phishing: Fake phone calls
In some reported instances, victims have received phone calls from criminals claiming to be Microsoft employees (etc.) informing them that their computer systems has been infected with malware, etc. These phone calls are in relation to this particular crypto-virus (read more here). If you receive any calls like this, keep in mind these are not Microsoft employees (nor a realistic service), and contact the proper law enforcement depending on your geographic location. These phone calls are defined as “phishing” schemes and may or may not be related to the FBI Moneypak virus.
What happens if the FBI virus is not removed?
If you are infected with ransomware such as the FBI virus, your personal and private data and computer system functionality is already at a very high risk. If the infected computer is powered ON and connected to the internet, Trojans horses may have complete control of the computer system and access to every piece of stored data. The main purpose of this ransomware is to target and scare unsuspecting victims into believing they are in trouble with a department of authority in order to willingly pay the fine stated on the prompted “alert page”, but that does not mean the infection will not hibernate (remain undetected) on an infected system in order to exploit vulnerabilities utilizing other malicious practices aside from locking the system. It has been reported that the FBI virus may collect private information while remaining in the background.