Social Engineering FAIL!

[EricKei]

AB: Hadn't thought of that. It seems that it disabled those functions, as well, tho. Whomever made this one, they weren't amateurs x.x Even just the WIndows ksy by itself didn't pop up a menu, as it normally does. Modal window that forced focus onto itself, perhaps? I forgot how I got it to ShutDown tho, probably just a power button tap.

Just as an aside, in Win7, Win+Tab has the same effect as ALT-Tab, with the added bonus of seeing 3-D-ish previews of the running apps/windows rather than just icons or little bitty windows.

[Krysalis]

My roomie recently had the virus/spyware version of this -- the second he tried to connect to the internet in any way (including updating his antivirus program), a screen-filling box with no way to minimize/close/move it popped up that disabled CTRL-ALT-DEL and every other method of getting rid of it, claimed it was from the FBI, and wanted $200 from him in order to re-enable his internet account, as it claimed he had downloaded something he shouldn't have ~_~

Fortunately, he at least thought to ask me about it. Was fun getting rid of it, but these guys forgot one little thing ... In Windows 7, there is an (apparently) intentional delay for a couple of seconds between "now shutting down all of your programs" and actually shutting down. If you cancel the shut down during those few seconds, you can get right back into Windows (albeit, likely with some of your TSR's terminated). Fortunately, the spyware app was apparently high on the list of stuff to preemptively kill, so I was able to get in, update AV, install AVG & SpyBot, and clean out his system using those. Took all night to scan in "DOS" mode, but heck, it worked ^_^

Did this once with a laptop with two of these fake A/Vs on it. God awful experience it was, but did find out where the programs laid and pulled a Linux Live CD on the laptop. Problem solved.

I just noticed one of my songs is over 1 gig. The song is 3 minutes, MP3. Managed to fix it by opening it up an a hex editor, taking a quick onceover to see that the entire end of the file, after the LAME marker at the end, is simply 00's Deleted the entire, gig worth of zeros, and it plays just fine. I blame file system error.

[MadMike]

If you Google "FBI MoneyPak virus" you'll find all kinds of articles on removing it. Not the easiest one to clean, but definately recoverable with just a bit of work.

I removed this from a friend's laptop a couple weeks ago. I forget which product I used, but I was still able to get into Windows thru Safe Mode and run the scanner.

It left a bit of a mess behind. The antivirus and Windows Updates were both disabled.