Hello,

Reference :

collect the load point diagnostics log and open a support ticket to identify suspicious files to be submitted to Security response.

You can run a scan in safemode

Hi greatgu,

"Thumbs up" to teh advice, above.  Please do update this thread with news of your progress.

Here is a good public blog post from Symantec Security Response about why ransomware has become so prevalent recently:
https://www-secure.symantec.com/connect/blogs/ransomware-crimeware-kits

Also see:  Ransomware and Silence Locker Control Panel
https://www-secure.symantec.com/connect/blogs/ransomware-and-silence-locker-control-panel

and: https://www-secure.symantec.com/connect/node/1618951

and https://www-secure.symantec.com/connect/blogs/ransomware-and-silence-locker-control-panel

I am trying to download SERT  from file connect but I don't know my product serial number. I am asking help from others.

Once you have SERT, call Tech Support for the PIN to allow it to run.

Symantec Endpoint Recovery Tool (SERT) requires a PIN to run
Article:TECH159200   |  Created: 2011-05-01   |  Updated: 2012-05-02   | 
Article URL http://www.symantec.com/docs/TECH159200 
 

HI,

Did you received your answer ?

Hi! Here http://www.symantec.com/connect/forums/fbi-moneypak-virus-corrupting-profiles-our-server I see the same problem, looks like this ransomware causes serious problems to many PCs.

I will suggest that you go into SafeMode and restore your system to a previous date whet it has been still not compromised. You can do that in the following way:

1. Use the F8 key to go into SafeMode with Command Prompt

2. In the Command Prompt line type explorer.exe, then press Enter

3. You will see your desktop, go to Start menu and type rstrui then you are taken to the System Restore point, where you can set your system to a moment in the past

Then, the system is unlocked, but FBI Moneypak is still there. Delete these files from your system (Windows XP):

C:\Documents and Settings\{Your User Name}\Start Menu\Programs\Startup\ctfmon.exe
C:\Windows\[Random.exe](eg. Pmfjyiaj.exe)
C:\Documents and Settings\ {User Profile} \Local Settings\Application Data\Microsoft\Windows\[Random.exe]
C:\Documents and Settings\ {User Profile} \Local Settings\Application Data\Microsoft\Windows\[Random]

and in Vista :

C:\Program Data\csrss.exe
C:\Users\{Your User Name}\AppData\Roaming\Microsoft\Windows\… Menu\Programs\Startup\ctfmon.exe
C:\Users\{User Profile}\AppData\Local\Microsoft\Windows… [Random.exe]
C:\Users\{User Profile}\AppData\Local\Microsoft\Windows… [Random]
C:\Program Data\lsass.exe
C:\Program Data\[Random.exe]

Do not forget to check your registry for any registry entry changes or malicious entries made to your registry. Set changed entries to their initial values.

You can also clean your system with an automatic tool like http://www.symantec.com/products/download-security-software , or http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=n95 and you can also see removal intructions here  http://www.americanpendulum.com/2012/10/02/fbi-moneypak-scam-dangerous-malware-making-millions-of/ and here http://www.youtube.com/watch?v=cuctc1_g0as

Hope this was helpful and you have managed to solve the problem!

This new Security Response whitepaper about Ransomware will be of interest to followers of this thread:

Ransomware: A Growing Menace
https://www-secure.symantec.com/connect/blogs/ransomware-growing-menace