![[Image: c283c.png]](https://i.imgur.com/c283c.png)
Hello guys I am Sib3r and today I would like to talk about and show how to remove the newest version of the FBI Moneypack virus aka Reveton.
First lets start with some history on this virus. The type of virus that this is known as is called Ransomware. Ransomware as defined on wikipedia reads:
Code
Ransomware (also referred to in some cases as cryptoviruses, cryptotrojans, cryptoworms or scareware) comprises a class of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator of the malware in order for the restriction to be removed. Some forms of ransomware encrypt files on the system's hard drive, while some may simply lock the system and display messages intended to coax the user into paying. Modern ransomware attacks were initially popular within Russia, but in recent years there have been an increasing number of ransomware attacks targeted towards other countries, such as Australia, Germany, and the United States among others.The virus itself is based on the Citadel trojan and that trojan is actually based off the zeus trojan. It will usually come up with saying from your local agency such as the FBI which is why this is also referred to as the FBI Moneypak virus also for the fact that the way the coder claims this virus can be removed is by simply paying the fine by using a Moneypak card. Trend Micro reports that the more common FBI version of this hit the states in about August 2012 but the FBI states this first came to their attention in 2011. The way that users can get tricked into thinking this may be real is by showing the users IP address and also will show footage from the victims webcam to give the illusion that they are being watched and recorded by law enforcement.
![[Image: KXU7v.png]](https://i.imgur.com/KXU7v.png)
The IC3 suggests the following if you become a victim of the Reveton virus:
- Do not pay any money or provide any personal information.
- Contact a computer professional to remove Reveton and Citadel from your computer.
- Be aware that even if you are able to unfreeze your computer on your own, the malware may still operate in the background. Certain types of malware have been known to capture personal information such as user names, passwords, and credit card numbers through embedded keystroke logging programs.
- File a complaint and look for updates about the Reveton virus on the IC3 website.
So Now lets get to the actual removal of the newest version of the virus that I am aware of.
Step 1. Turn off your PC.
Step 2. Launch into safe mode with command prompt. (the reason for this is because in the new version if you try to launch it with networking it will restart your computer and not give you a chance to launch it)
Step 3. After you are setup and you see command prompt then you need to make sure it says C:/WINDOWS/system32/ if you do not see this then type in cd.. until you see C:/ once you see that type cd WINDOWS then cd System32.
Step 4. Type in control.exe to launch the control panel.
Step 5. After it launches navigate to manage another user or create new user at that point make sure the account is set to a administrator account.
Step 6. After the account is made you need to restart the computer.
Step 7. After your computer starts back up it should give you the option to log into your new account you made but if it did not no worries if you are on windoes 7/8 just do your friendly control alt del and click switch user. If you are on xp then winkey+L and it will take you to the login screen.
Step 8. After accessing the new account download malwarebytes anti malware and install it and make sure that you have your database updated and after that is done run a full scan and let it work.
Final Step. Once the scan is complete, you must click the Show Results button in the lower right-hand corner of Malwarebytes. This will bring you to a new screen with a list of all infections found. Check the check box to the left of every item in the list, then click Remove Selected. You will be prompted to restart your computer. The infected files will not be removed until you restart. Once the computer boots back up, your regular user account should be in proper working order. You can now go back to Control Panel then User Accounts and remove the temporary user account created.
Ok guys well thank you for reading over this it took me a while to make this thread and I hope it can help people out but I hope no one gets infected with this virus as it can just be a simple pain in the ass. If anyone has anything to add or any questions feel free to post below. Also I came up with the idea for this thread when last night a friend I know irl got infected by it and he called me freaking out it was a little funny.
