FBI Computer Warning Virus

Threat Summary

Threat Name:FBI Warning Virus
Brief Description:This type of malware locks the computer or desktop making it unusable.
Detected as:Trojan.Ransomlock.Y


FBI Computer Warning is a fake desktop message that will appear on every infected system. Obviously, the virus will disguise as if the message is coming from the authority – Federal Bureau of Investigation (FBI). The truth is, this warning is dubious and was created by malware authors to deceive computer users worldwide. Fake FBI Computer Warning tends to spread all over the world with the use of a rootkit Trojan that is capable of entering the computer by finding security flaws on target PC.

Once it enters the system, Trojan instantly moves towards the system folder to make changes to files and registry. Then, it locks the desktop and displays a fake alert saying that “Your Computer has been locked”. The desktop is indeed locked, but the FBI did not do it. This ransom-type attack has been around due to malware authors that expect to earn a profit from this FBI Computer Warning. Actually, attackers created several variants of this such as FBI Anti-Piracy and FBI Online Agent.

Nothing you can do when fake FBI Computer Warning virus resides inside the machine. The malware prevents every program to be executed. The only working and accessible area is the FBI desktop message. You need to get a MoneyPak voucher in order to unlock the computer. However, we do not advise this method. By doing this, you are giving malware authors a reason to earn and continue with this illegal act. Start removing FBI Computer Warning virus by scanning the computer with Wndows Unlocker tool courtesy of Kaspersky. Complete removal procedure is located in a section below.

What are symptoms of FBI Computer Warning Virus Infection?

First issue of FBI Computer Warning virus uses the design as you can see in the image below. MoneyPak was the first payment scheme if user wants to pay the fine designated by the ransom program.

FBI Virus Version 1

Second version displays a much bigger text for the warning “Your PC is blocked due to at least one of the reasons specified below”. Again, it wants you to load cash on MoneyPak by entering the code.

FBI Warning 2

For other versions of the FBI fake warning, you may view FBI Online Agent image, FBI Anti-Piracy Warning image, FBI Game Card, and FBI MoneyPak image.

Procedures to Remove FBI Warning Virus

Removal steps on this page will help you get rid of the threat effectively using tools and virus scanners. Please make sure that you will carry out the guide in exact order.

Create a USB Bootable Device

Ransom Trojans and viruses will lock the screen and makes the computer unusable. Common ways to deal with this type of infection is to boot the PC using another device. For this tutorial we will do a bootable disk that contains FBI Warning Virus remover.

1. Download Kaspersky Rescue Disk from their official server. Click the button below. The file will be in .ISO format.

2. Download this utility called rescue2usb to record your .ISO file into the USB drive. Obviously you need a USB thumb drive at least 512MB in capacity. Plug it to the computer.

3. Once you have the two programs, double-click on the rescue2usb.exe to start creating a bootable USB drive.
4. You will see on the screen in the program called Kasperksy USB Rescue Disk Maker. Click on Browse and locate the .ISO file.
5. Under USB Medium, select the proper drive of your USB device.
6. Click on START. It will now begin to create a bootable USB drive with Kaspersky Rescue Disk in it.

Start the Computer with Kaspersky Rescue Disk.

1. You must set the computer to use other bootable device aside from hard drive. For this procedure, enable your BIOS to boot to USB device. If you are not familiar with this, please refer to your computer's instruction manual.

2. Another option is to access the Boot Menu right after you turn one the PC. It will present a Menu so that you can select a preferred boot drive. Select Removable Devices.

Boot Menu

3. Your computer will now start and load Kaspersky Rescue Disk.
4. If you see a message on the screen, please Press any key to enter the menu. You only have 10 seconds to do this, otherwise it will boot with the hard drive.

5. Next screen will be the interface language. Please select desired language to use.
6. You must run the program in Graphic Mode. This gives you easy access to all commands and menus.
7. End User License Agreement will appear. Please accept to continue using the program. Press 1 to proceed.

Using WindowsUnlocker to Remove FBI Warning Virus

1.Click on the K button at the lower left corner of the screen.

2. Select Terminal on the list. It will open a command prompt.
3. Type windowsunlocker and press Enter on your keyboard.

4. On WindowsUnlocker menu, please type 1 to Unlock Windows. This utility will clean the registry for malicious entries.

5. After the cleanup process, it will display the menu once more.
6. Press 0 on your keyboard to exit WindowsUnlocker.

Run a Virus Scan

1. After removing FBI Warning Virus, you need to delete all remaining components.
2. Click on the K to display the menu.

3. Select Kaspersky Rescue Disk. This will open the virus scanning tool.
4. You need to update the program first. Select My Update Center tab and click on Start update. This requires an Internet connection.

5. After updating the program, select Object Scan tab and click on Start Object Scan. You must scan the following:

  • Disk boot sectors
  • Hidden startup objects
  • All drives

6. Scanning the entire hard drive may take some time. Please let the scan to finish.
7. Once the scan process is complete, the tool will prompt you for preferred actions on detected threats. Deleting all threats is recommended.
8. You can now turn off the computer, unplug the USB drive, and start Windows in normal mode.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>