[28012] in resnet
Re: FBI Moneypak ramsonware
daemon@ATHENA.MIT.EDU (Miller, Ralph Michael)
Mon Oct 8 09:43:25 2012
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID: <67EE15F2BAE941429D7AC9ABD514229D13B69B915A@PITT-EXCH-13.univ.pitt.edu>
Date: Mon, 8 Oct 2012 09:37:27 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Miller, Ralph Michael" <rmmiller@pitt.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <9AF279DD359BD14DA5F7B23E04570DE029DAC0@exch-mbx01.exchange.upenn.edu>
I have used MS offline tool in the past and had good success with it.
http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline
Ralph M. Miller
ResNet/Technology Services Coordinator
University of Pittsburgh at Johnstown
rmmiller@pitt.edu
This post made with 100% recyclable electrons.
No electrons were harmed during the composition of this message
-----Original Message-----
From: Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] On Behalf Of Caroline Couture
Sent: Monday, October 08, 2012 9:25 AM
To: RESNET-L@LISTSERV.ND.EDU
Subject: [RESNET-L] FBI Moneypak ramsonware
Hi Folks!
I knew such things existed but I've never seen this in person until now.
We tried using some of the various "typical" tools for removal, SuperAntiSpyware and the AVG boot disk, had no luck, and the manual removal instructions don't match up with what we are seeing but this may be because we tried removing it with anti-virus applications first.
Has anyone successfully cleaned a machine with this ransomware? Or should I not waste my time and just reformat. (Which will be painful since the student probably doesn't have her software since the computer is two year old.)
Thanks!
Caroline
"We're all going to die, all of us, what a circus! That alone should make us love each other but it doesn't. We are terrorized and flattened by trivialities, we are eaten up by nothing." - Charles Bukowski
Caroline Couture
College House Computing
3702 Spruce Street
215.573.3887
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
