[28014] in resnet
Re: FBI Moneypak ramsonware
daemon@ATHENA.MIT.EDU (Sabol, Jim)
Mon Oct 8 10:01:58 2012
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
X-MailScanner-From: jim.sabol@unh.edu
Content-Transfer-Encoding: 8bit
Message-ID: <3F730FE443CD014D9ADD3F69F92AC9D62FC73D15@bow.ad.unh.edu>
Date: Mon, 8 Oct 2012 13:59:07 +0000
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Sabol, Jim" <jim.sabol@unh.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <FA50E010-ACC2-4CF3-ADA2-CC9C78F23DB0@smcvt.edu>
Combofix will also take this out.
-Jim
University of New Hampshire
-----Original Message-----
From: Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] On Behalf Of Lightbody, Erik J
Sent: Monday, October 08, 2012 9:33 AM
To: RESNET-L@LISTSERV.ND.EDU
Subject: Re: FBI Moneypak ramsonware
I used MalwareBytes in Safe Mode and had no trouble removing this infection.
--Erik Lightbody
Saint Michael's College
On Oct 8, 2012, at 9:25 AM, "Caroline Couture" <caroline@pobox.upenn.edu> wrote:
> Hi Folks!
>
> I knew such things existed but I've never seen this in person until now.
>
> We tried using some of the various "typical" tools for removal, SuperAntiSpyware and the AVG boot disk, had no luck, and the manual removal instructions don't match up with what we are seeing but this may be because we tried removing it with anti-virus applications first.
>
> Has anyone successfully cleaned a machine with this ransomware? Or
> should I not waste my time and just reformat. (Which will be painful
> since the student probably doesn't have her software since the
> computer is two year old.)
>
> Thanks!
> Caroline
>
> "We're all going to die, all of us, what a circus! That alone should
> make us love each other but it doesn't. We are terrorized and
> flattened by trivialities, we are eaten up by nothing." - Charles
> Bukowski
>
> Caroline Couture
> College House Computing
> 3702 Spruce Street
> 215.573.3887
>
> ___________________________________________________
> You are subscribed to the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives, go to
> http://LISTSERV.ND.EDU/archives/resnet-l.html
> ___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
