dslreports logo
site
    All Forums Hot Topics Gallery
spc
Search Topic:
uniqs
2120
share rss forum feed

Pudd

join:2013-06-01

fbi virus

Greetings

This occurred on someone else's computer and I'm trying to remove it.
They encountered the fbi money scam screen and could not use the pc at all.
F8 did not work.

I turned on the pc , tried F8 as pc was starting up but didn't work. Completely white screen, was as if something was trying to load but never did.
Restarted - got a normal looking desktop except for a small warning box in lower right corner.

Warning! Infected file detected!
Location: File system
File name: listener.exe
Level of threat: (shows two red bars)
Behavior description: Destroys and infects system files.
To keep the computer safe the threat must be blocked.
(two options displayed) X Buy full edition .... X Continue

Steps taken:
no linkification installed
no Spybot S&D installed
no AdAware installed
Have checked 'show hidden files and folders"
Can't open Notepad
Can't open Windows defender but it is disabled
Avast had been disabled

I cannot open firefox.

Can not use Internet Explorer: tried to go to TFC website and Malwarebytes website. IE gives a warning message and will not go to any website.

Tried using a flash drive loaded with TFC.exe and Mabam-setup-1.75.0.1300.exe and, while I can slide the icon onto the desktop, I can't open or start the programs. Tried all with 'run as administrator'.

Trying to start any program just brings up the above mentioned warning box.
Cannot remove any programs.

I searched but have not found a similar situation on the forums.
Thank you for any help or suggestions.


lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:57
Have you tried a rescue disk if F8 isn't booting to safe mode?

Pudd

join:2013-06-01
no havent tried that, are you talking about like a kaspersky rescue disk?


LoPhatPhuud
Premium,VIP,MVM
join:2002-01-06
Albuquerque, NM
kudos:26
Reviews:
·Comcast

1 recommendation

reply to Pudd
You can try the Kaspersky Rescue disk. If your computer is capable of booting from a USB drive, yu can use these instructions;
»www.bleepingcomputer.com/virus-r···nsomware

Pudd

join:2013-06-01
thanks, ill give it a try


lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:57
Reviews:
·Comcast

2 edits
If you get through that...try again to follow the steps below - we'd love to give you an all clear, if you're up to the task

»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance
Our FAQ will tell you what programs we need and how to attempt to get them to run .

It will also show what logs need to be attached to your post - as well as where & how to locate them

Post back when you're ready, we'll be waiting

»Security Cleanup FAQ »So...What is this Forum all about?

Try to not run any additional apps (sec, or otherwise) unless your "helper" advises.
--
~Safe Hex~ Team Discovery ~ Project Hope ~ Like A Hurricane~

Pudd

join:2013-06-01
thanks so far, system is unlocked.
was able to run an installed av (avast) and remove enough to get the browsers working.

As Instructed -> rescue disk - used a usb flash with hitman pro on it and removed several trojans along with a huge variety of other nasty stuff.

ran avast again, one full system scan and one boot time scan - found bunches of other infections.

have removed some nefarious looking programs and used ccleaner to improve function.

system seems to be running well. i realize this may not be the end of the story but ive got to take some online tests for school and must take a break til maybe later today or this week.

thank you very much for being there! much appreciate your time 3.
i intend to follow the security clean up path asap and attach logs as instructed.