# I got hit by FBI Moneypack Virus.  Now what?

**URL:** <https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309>\
**Category:** In My Humble Opinion\
**Created:** [June 8, 2014, 1:50am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309 "2014-06-08T01:50:17Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Mace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/john_mace/32/185_2.png) [@John\_Mace](https://boards.straightdope.com/u/John_Mace)\
**Post date:** [June 8, 2014, 1:50am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/1 "2014-06-08T01:50:17Z")

</div>

This is the virus that locks your computer and says you need to pay $X to get it unlocked. It looks like an FBI web site, but then says you have to go to Walgreens (or some other place) and get a card to pay them.

I don’t know how the hell I got it off my screen, but I did. I unplugged my router and cut power to my Mac. I clicked and clicked and finally was able to restart my computer.

So, my question is: Now what? Do I need to do some security sweep of my computer? Do I need to change all my passwords?

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [June 8, 2014, 2:00am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/2 "2014-06-08T02:00:26Z")

</div>

I use [Hitman Pro](http://www.majorgeeks.com/files/details/hitman_pro.html)to remove the FBI malware. It provides a 30 day trial of the full program, after which you may purchase it for future use.

It also includes a feature called “Kickstarter”, which allows you to create a bootable USB flash drive which will bypass the FBI lockout screen.

---

<div class="post-metadata">

**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\
**Post date:** [June 8, 2014, 2:08am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/3 "2014-06-08T02:08:04Z")

</div>

[The Norton Method.](https://support.norton.com/sp/en/us/home/current/solutions/v71075396_EndUserProfile_en_us)  
[Various other options.](http://botcrawl.com/how-to-remove-the-fbi-moneypak-ransomware-virus-fake-fbi-malware-removal/)

---

<div class="post-metadata">

**Author:** ![John\_Mace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/john_mace/32/185_2.png) [@John\_Mace](https://boards.straightdope.com/u/John_Mace)\
**Post date:** [June 8, 2014, 2:18am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/4 "2014-06-08T02:18:15Z")

</div>

I should have noted that I have a MacBook Pro with IO X version 10.8.3

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [June 8, 2014, 3:12am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/5 "2014-06-08T03:12:32Z")

</div>

> [@John\_Mace](#):
>
> I should have noted that I have a MacBook Pro with IO X version 10.8.3

Wow. I wasn’t aware the FBI malware had been adapted for Mac. I’ll bet that will come as a surprise to a lot of people.

---

<div class="post-metadata">

**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\
**Post date:** [June 8, 2014, 3:16am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/6 "2014-06-08T03:16:17Z")

</div>

I’ve had good luck booting into safemode and using Malwarebytes and Combofix. Sometimes you have to run it more than once, resetting after each run to totally clean it up.

---

<div class="post-metadata">

**Author:** ![drewtwo99](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@drewtwo99](https://boards.straightdope.com/u/drewtwo99)\
**Post date:** [June 8, 2014, 4:53am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/7 "2014-06-08T04:53:09Z")

</div>

What about going down and buying a Moneypak to pay off the FBI? Can never be too safe! In for a penny, in for a pound!

😃

---

<div class="post-metadata">

**Author:** ![Leaper](https://avatars.discourse-cdn.com/v4/letter/l/4bbf92/32.png) [@Leaper](https://boards.straightdope.com/u/Leaper)\
**Post date:** [June 8, 2014, 5:00am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/8 "2014-06-08T05:00:39Z")

</div>

> [@Fear\_Itself](#):
>
> Wow. I wasn’t aware the FBI malware had been adapted for Mac. I’ll bet that will come as a surprise to a lot of people.

According to [this,](http://blog.malwarebytes.org/fraud-scam/2013/07/fbi-ransomware-now-targeting-apples-mac-os-x-users/) it’s not actually a Trojan, but an exploit of Safari’s Javascript system. Apparently, if you just closed the window enough times, it would eventually go away.

---

<div class="post-metadata">

**Author:** ![John\_Mace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/john_mace/32/185_2.png) [@John\_Mace](https://boards.straightdope.com/u/John_Mace)\
**Post date:** [June 9, 2014, 1:28am UTC](https://boards.straightdope.com/t/i-got-hit-by-fbi-moneypack-virus-now-what/690309/9 "2014-06-09T01:28:15Z")

</div>

> [@Leaper](#):
>
> According to [this,](http://blog.malwarebytes.org/fraud-scam/2013/07/fbi-ransomware-now-targeting-apples-mac-os-x-users/) it’s not actually a Trojan, but an exploit of Safari’s Javascript system. Apparently, if you just closed the window enough times, it would eventually go away.

Looks like once it’s gone, it’s gone. I wouldn’t have thought I tried 150 times, but I guess I did. I was clicking like crazy, hoping that the expression about the definition of insanity didn’t apply. 🙂
