{"id":1159,"date":"2013-07-30T03:37:30","date_gmt":"2013-07-30T08:37:30","guid":{"rendered":"http:\/\/swildow.darktech.org\/wp\/?p=1159"},"modified":"2013-07-30T03:37:30","modified_gmt":"2013-07-30T08:37:30","slug":"fbi-virus-manual-removal","status":"publish","type":"post","link":"http:\/\/www.wildow.com\/blog\/?p=1159","title":{"rendered":"FBI virus manual removal:"},"content":{"rendered":"

FBI virus manual removal:<\/h3>\n
\n
\n
\"forum\"ASK US:
\n<\/a>Submit question<\/a>\u00a0about FBI virus<\/div>\n
http:\/\/www.2-spyware.com\/remove-fbi-virus.html<\/a><\/div>\n
<\/div>\n<\/div>\n<\/div>\n

Kill processes:
\ntpl_0_c.exe
\nch810.exe
\n0_0u_l.exe
\n[random].exe
\njork_0_typ_col.exe
\nvsdsrv32.exe
\nProtector-[rnd].exe
\nInspector-[rnd].exe<\/p>\n

\"help\"HELP:
\nhow to kill malicious processes<\/a><\/div>\n

Delete registry values:
\nHKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\[random].exe
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\FBI Moneypak Virus
\nHKEY_CURRENT_USER \\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \u2018DisableRegistryTools\u2019 = 0
\nHKEY_LOCAL_MACHINE \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system \u2018EnableLUA\u2019 = 0
\nHKEY_CURRENT_USER \\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \u2018WarnOnHTTPSToHTTPRedirect\u2019 = 0
\nHKEY_CURRENT_USER \\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \u2018DisableRegedit\u2019= 0
\nHKEY_CURRENT_USER\\Software\\FBI Moneypak Virus
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \u2018Inspector\u2019
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FBI Moneypak Virus
\nHKEY_CURRENT_USER \\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \u2018DisableTaskMgr\u2019 = 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\protector.exe
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Inspector %AppData%\\Protector-[rnd].exe
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnHTTPSToHTTPRedirect 0
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings\\ID 4
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings\\UID [rnd]
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings\\net [date of installation]
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system\\ConsentPromptBehaviorAdmin 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system\\ConsentPromptBehaviorUser 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system\\EnableLUA 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AAWTray.exe
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AAWTray.exe\\Debugger svchost.exe
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AVCare.exe
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AVCare.exe\\Debugger svchost.exe
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AVENGINE.EXE
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AVENGINE.EXE\\Debugger svchost.exe
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \u201cDisableRegistryTools\u201d = 0
\nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \u201cDisableTaskMgr\u201d = 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system \u201cConsentPromptBehaviorAdmin\u201d = 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system \u201cConsentPromptBehaviorUser\u201d = 0
\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system \u201cEnableLUA\u201d = 0<\/p>\n

\"help\"HELP:
\nhow to remove registry entries<\/a><\/div>\n

Unregister DLLs:
\nwpbt0.dll<\/p>\n

\"help\"HELP:
\nhow to unregister malicious DLLs<\/a><\/div>\n

Delete files:
\n%Program Files%\\FBI Moneypak Virus
\n%AppData%\\Protector-[rnd].exe
\n%AppData%\\Inspector-[rnd].exe
\n%AppData%\\vsdsrv32.exe
\n%AppData%\\result.db
\n%AppData%\\jork_0_typ_col.exe
\n%appdata%\\[random].exe
\n%Windows%\\system32\\[random].exe
\n%Documents and Settings%\\[UserName]\\Application Data\\[random].exe
\n%Documents and Settings%\\[UserName]\\Desktop\\[random].lnk
\n%Documents and Settings%\\All Users\\Application Data\\FBI Moneypak Virus
\n%CommonStartMenu%\\Programs\\FBI Moneypak Virus.lnk
\n%Temp%\\0_0u_l.exe
\n%Temp%\\[random].exe
\n%StartupFolder%\\wpbt0.dll
\n%StartupFolder%\\ctfmon.lnk
\n%StartupFolder%\\ch810.exe
\n%UserProfile%\\Desktop\\FBI Moneypak Virus.lnk
\nWARNING.txt
\nV.class
\ncconf.txt.enc
\ntpl_0_c.exe<\/p>\n

\"help\"HELP:
\nhow to remove harmful files<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

FBI virus manual removal: ASK US: Submit question\u00a0about FBI virus http:\/\/www.2-spyware.com\/remove-fbi-virus.html<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1159"}],"collection":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1159"}],"version-history":[{"count":2,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1159\/revisions"}],"predecessor-version":[{"id":1161,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1159\/revisions\/1161"}],"wp:attachment":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1159"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}