Threat Database Ransomware Fake FBI Anti-Piracy Warning

Fake FBI Anti-Piracy Warning

By Sumo3000 in Ransomware

The Fake FBI Anti-Piracy Warning is part of a ransomware Trojan attack. This ransomware infection attempts to steal $200 USD from victims by impersonating the FBI (America's federal police, the Federal Bureau of Investigation). Like similar fake police message ransomware infections, the Fake FBI Anti-Piracy Warning accuses the victim of illegal activities, claiming that the victim's computer was blocked by the FBI as a deterrent for these kinds of acts. There are dozens of variants of the Fake FBI Anti-Piracy Warning which usually demand payment through the Green Dot MoneyPak money transfer system. Malware that blocks access to Windows and pretends to be a message from a law enforcement agency is quite common and should be removed with a reliable anti-malware program.

Common Sources of Fake FBI Anti-Piracy Warning Infections

The Fake FBI Anti-Piracy Warning infection is typically distributed using Trojan infections. These Trojan infections are typically distributed using fake video codecs or application updates, usually distributed in shady websites with unsafe content. The Fake FBI Anti-Piracy Warning infects the victim's computer, locking access to Windows and preventing the victim from accessing typical Windows components that are useful when dealing with malware infections (such as the Windows Registry, the Windows Task Manager and System Restore).

When the victim tries to log into Windows, a full screen message is displayed. This message claims to be an official letter from the FBI, claiming that your computer was blocked by the FBI because it was involved in illegal activities such as distributing pornographic material and copying media files illegally. The Fake FBI Anti-Piracy Warning then claims that the victim needs to pay $200 USD via MoneyPak in order to unblock the affected computer. However, paying the Fake FBI Anti-Piracy Warning's 'fine' will not erase this threat from your machine or restore your computer to normality.

The main issue when dealing with a computer infected with the Fake FBI Anti-Piracy Warning Trojan is to bypass this ransomware infection's message and gain access to the affected computer. To do this, ESG security researchers advise starting up Windows using an alternate boot method. According to ESG malware researchers, using an external drive to start up Windows or Safe Mode with the command prompt to access the Windows Registry are methods that have proven effective in case of Fake FBI Anti-Piracy Warning attacks.

File System Details

Fake FBI Anti-Piracy Warning may create the following file(s):
# File Name Detections
1. %WinDir%\.exe
2. %CommonAppData%\.exe
3. %CommonAppData%\\step.png
4. %CommonAppData%\\mcafee-lock.png
5. %CommonAppData%\\money.gif
6. %CommonAppData%\\logo-text.gif
7. %CommonAppData%\\green-l.png
8. %CommonAppData%\\larr.gif
9. %CommonAppData%\\bg.wav
10. %CommonAppData%\\btn-sq.gif
11. %CommonAppData%\\wait.html
12. %CommonAppData%\\step.gif
13. %CommonAppData%\\payments-en.png
14. %CommonAppData%\\main.html
15. %CommonAppData%\\locked-text-en.png
16. %CommonAppData%\\ie7.css
17. %CommonAppData%\\card.jpg
18. %CommonAppData%\\cam-place.bmp
19. %CommonAppData%\\btn.png
20. %CommonAppData%\
21. %CommonAppData%\\side-block.png
22. %CommonAppData%\\style.css
23. %CommonAppData%\\moneypak.png
24. %CommonAppData%\\mainbg.gif
25. %CommonAppData%\\logo-img.png
26. %CommonAppData%\\green-r.png
27. %CommonAppData%\\lock.png
28. %CommonAppData%\\b-sep.gif
29. %CommonAppData%\\arr-next.gif

Registry Details

Fake FBI Anti-Piracy Warning may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]" = "C:\WINDOWS\[RANDOM CHARACTERS].exe;"

Trending

Most Viewed

Loading...