Thursday, November 15, 2012

Useful Tips on How to Manually Remove FBI Online Agent Virus Greendot MoneyPak Ransom (FBI Online Agent has blocked your computer for security reason)

Computer is blocked by FBI Online Agent virus fake warning window? Knowing well that it's a hoax but having no idea how to get the computer into use? This post and Tee Support online tech support team will help you out with manual approach efficiently.

How Much Do You Know about FBI Online Agent Virus

FBI Online Agent virus, the newest variant of FBI Greendot Moneypak ransom that calls for a fine to unblock the computer and targets Windows machines in USA, makes a strong headline of ''FBI Online Agent has blocked your computer for security reason'' with a red background and an exclamation mark. Just like its earlier versions, this piece states that illegal activities such as copyright,pornography, terrorism promotion and neglect computer use have been detected, and the owners must be effect the fine of $200 within 24 hours, or they will become the subject of the prosecution. Hackers also add in some innovations such as the signature of ''FBI Headquarters in Washington, D.C'' and some evidence of violations, namely some picture and video files. All the attempt are made to convince users into thinking that they are targeted by security forces and even might be prosecuted.
Fortunately more and more users are able to see through the fraud and refuse the payment. But here comes the major problem too, since the computer is totally locked no mater how many times you restart. You are not alone loss access to desktop and fail to open program from start menu. Besides, Windows task manager cannot be opened either.  Everything seems to be out of control all of a sudden, and the only working part is the mouse which may be used for inputting the Moneypak voucher pin-but they are not all what you can do. It's created as computer virus, and it surely has the solution to decode the infection mechanism and the supporting ransom Trojan which steals necessary information from the target computer before launching the scamware page.

FBI Online Agent Virus Screenshot

 

Why There's No One-stop Tool to Remove FBI Online Agent Virus?

As mentioned above, the virus rears its head once you log in before you can open any program, let to speak of activating any security tools. Even it's not fully locked in some occasions and you make it to pick up the Trojan, the detecting device won't completely remove it with an explanation that some parts need to be deleted manually which you don't know how.  Having no clue how to get rid of FBI Online Agent has blocked your computer for security reason'' locker screen? Read over below manual removal steps which you can take as reference:
Steps 1: Restart into safe mode with networking by pressing and holding F8 and selecting the needed mode with arrow keys.
Step 2 : Go to Task Manager with Alt+Ctrl+Delete and stop its process.
random.exe
Step 3: Search for and delete its related files in Local Disk C:
%userprofile%\Local Settings\Application Data\Microsoft\Windows\912\WSManHTTPConfig.exe
Step 4: Navigate to remove the registry entries associated as below in Registry Editor:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-2-17_2"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rudbxijemb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe
Notes: If you are still confused with above procedure, please click here to talk with an online expert for more details.


No comments:

Post a Comment