Snowball Random | Keep it Simple and Random

How to Remove FBI Moneypak Virus/Malware That Blocked PC Asks For Payment

Posted on December 30, 2012 by kylecoots

Ok so I recently encountered the FBI Moneypak Virus/Malware.

FBI Moneypak Virus/ Malware is defined as a ransomware.

Is FBI Moneypak fine legit? No! It’s a scam and you shouldn’t pay anything!

Removing this Virus/Malware from your computer.

This should be fairly easy in most cases, to remove the Virus/Malware follow along with the short tutorial below. To get started here is a screen shoot of what it may look like, although it may be slightly different in each case.

To begin the removal of this bogus Virus/Malware scam from your computer, begin by restarting you computer and starting windows in safe mode by repeatedly pressing the F8 key during your computers startup, before the windows logo appears.

You will want to select the “Safe Mode” option and if you need internet to refer back to this article during the removal process, then select the “Safe Mode with Networking” option.

After your computer starts and windows is loaded, log in to your account as normal. After logging you will want to start task manager by dooing one of the following:

Option 1
Pressing ctrl+alt+delete at the same time and selecting the “Start Task Manager”

Option 2
Click start button and typing “task manager” in the search fileld and pressing return/enter

After task manager is open you will want to select the tab “Processes” and look for the process labeled “ctfmon”.

You will want to right click on that process and select the “End Process” option from the drop down menu. Close the task manager.

Removing the actual FBI Moneypak Virus/ Malware Files

Now you will need to click on the start button and in the search filed type the following ” %appdata% ” (with out quotes) and press return/enter.

You should now have Windows Explorer open and be in a directory
” C:\Users\USER NAME\AppData\Roaming ”

You will want to navigate to:
C:\Users\USER NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

In this directory you may notice several files, depending if you have several applications/programs that start when your computer does, you will want to look for a file named “runctf” or “runctf.lnk” and delete it.

This is the file that starts the stupid FBI Moneypak Virus/Malware thing when your computer starts. This is one of the reasons why we started in safe mode, to disable all the start up programs.

The next file is located at C:\ProgramData\ and this file may have a funny and long name, on my machine it was labeled dsgsdgdsgdsgw.pad and another with the same name only with a *.js file extension like so, dsgsdgdsgdsgw.js. You will want to remove them both.

The next file for the FBI Moneypak Virus/Malware is located in C:\User\User Name\ and is\was labeled “wgsdgsdgdsgsd.dll”. Remove this file as well.

If everything went smoothly you can now restart your computer and if all went well your computer should start with out the annoying FBI Virus/Malware message.

Conclusion / Final Thought

As always it may be a good idea to run Malwarebytes to be sure we got everything. You can download Malwarebytes here for free.

I have also noticed others claiming the need to go into the registry to remove key from the registry, I never noticed any entry’s that needed to be removed but in case you want to look for your self here they are.

HKCU-Software-Microsoft-Windows-CurrentVersion-Run-Inspector AppData-.exe Software-CurrentVersion-Internet Settings-Warn0 HKCU-Software-ID 4

HKCU-Software-Microsoft-Windows-CurrentVersion-Settings-HKCU-Software-Microsoft-CurrentVersion-Settings-net

HKLM-SOFTWARE-Microsoft-Windows-CurrentVersion-policies-system-ConsentPromptBehaviorAdmin 0 HKLM-SOFTWARE-svchost.exe

HKLM-SOFTWARE-Microsoft-Windows NT-CurrentVersion-Image File Execution Options-AVCare.exe HKLM-SOFTWARE-Microsoft-Windows NT-CurrentVersion-svchost.exe

HKLM-SOFTWARE-Microsoft-Windows NT-CurrentVersion-Image File Execution Options-AVENGINE.EXE

HKLM-SOFTWARE-Microsoft-Windows NT-CurrentVersion-Image File Execution Optionsr svchost.exe

Posted in Malaware/Spyware/Virus/Trojan | Tagged FBI Green dot Moneypak, FBI warning popup, How can i unlock my computer and get rid of the fake FBI Green dot Moneypak virus, Malware locked my account, PC blocked with the child porn FBI Moneypak virus/ malware, ransomware | Comments Off

Codeigniter custom 404 page and show_404 function

Posted on November 27, 2012 by kylecoots

If your looking to cusomize the default 404 page thats displayed when a user enters an invalid URL, with your codeigniter application, there are a few different way in which you can do this.

Codeigniter Default 404

So your ready to modify your default 404 page for your codeigniter application?

error_404.php
To modify the default page open up the default error_404.php in your faviorte text/html editor and make the changes you would like.

The default 404 file is located at “/application/errors/error_404.php”

If your looking to get a bit more creative and wrap your 404 page in a template we can do this by extending CI_Exceptions.

First, create a file in your “/applications/core/” directory labeled “MY_Exceptions”, unless you have changed the default subclass_prefix in the “/applications/config/config.php” file, by default it should look like this:

$config['subclass_prefix'] = 'MY_';

1	$config['subclass_prefix'] = 'MY_';

Take notice that “MY_” is uppercase, the file you created in the core directory will need to reflect this exactly. Your file should be labeled exactly as shown: “MY_Exceptions.php”

Again if you have changed this prefix in your config file you will need to label your file to reflect the same prefix, i.e.

$config['subclass_prefix'] = 'YouR_';

1	$config['subclass_prefix'] = 'YouR_';

Would be: “YouR_Exceptions.php”

Now open that file in you text editor and add the following code:

<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed'); 
class MY_Exceptions extends CI_Exceptions {

    function __construct(){
        parent::__construct();
    }

    function show_404(){ // error page logic
        header("HTTP/1.1 404 Not Found");
        // First, assign the CodeIgniter object to a variable
        $CI =& get_instance();

        // do what you want here, even db stuff or just 
        // load your template with a custom 404
        $data['heading'] = "404 Page Not Found";
        $data['message'] = "The page you requested was not found ";
        $data['main_content'] = 'errors/error_404';
        $CI->load->view('includes/template', $data);
    }
}
?>

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class MY_Exceptions extends CI_Exceptions {

function __construct(){

parent::__construct();

}

function show_404(){ // error page logic

header("HTTP/1.1 404 Not Found");

// First, assign the CodeIgniter object to a variable

$CI =& get_instance();

// do what you want here, even db stuff or just

// load your template with a custom 404

$data['heading'] = "404 Page Not Found";

$data['message'] = "The page you requested was not found ";

$data['main_content'] = 'errors/error_404';

$CI->load->view('includes/template', $data);

}

If your curious about the ” $CI =& get_instance(); “ you can read more about that in the codeigniter manual here:
http://ellislab.com/codeigniter/user-guide/general/creating_libraries.html

I must also point out that in the above script im using a template file located in “/includes/template/” and am passing data to the file. the below is an example of how this file might look.

<?php
    // Check if user is logged in and pass the data needed based on that. 
    if($this->session->userdata('is_logged_in')){       
        $data['account'] = $this->member_model->get_basic_user_info();
        $data['profile_photo'] = $this->member_model->get_profile_photo();    
        $this->load->view('includes/header', $data);
    }else{
        $this->load->view('includes/header');        
    } 

    // Always load these pages  
    $this->load->view('includes/nav');
    $this->load->view('includes/pannel');
    $this->load->view($main_content);
    $this->load->view('includes/footer');
?>

<?php

// Check if user is logged in and pass the data needed based on that.

if($this->session->userdata('is_logged_in')){

$data['account'] = $this->member_model->get_basic_user_info();

$data['profile_photo'] = $this->member_model->get_profile_photo();

$this->load->view('includes/header', $data);

}else{

$this->load->view('includes/header');

}

// Always load these pages

$this->load->view('includes/nav');

$this->load->view('includes/pannel');

$this->load->view($main_content);

$this->load->view('includes/footer');

Your template file may be a little different. The main thing to notice here is the variable “$main_content” . This is the variable passed containing the path to our error_404.php page in our MY_Exceptions.php file.

Now create a directory in your “/application/views/” labeled “errors” and create a file labeled “error_404.php”.

Now open that file and place the following code inside and save it.

<div id="Not_found" style="margin-top:50px;padding:20px;">
    <h2><?php echo $heading; ?></h2>  
    <?php echo $message; ?>  
</div>

<?php echo $message; ?>

</div>

Now in your controller all you have to do is call the show_404() function like so:

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
class Someclass extends CI_Controller{
    
    public function __construct(){
       parent::__construct();
    }   

    function view($page = ''){
       if($member_page = file_exists(APPPATH . 'views/members/' . $page . '.php')){        
          $data['main_content'] =   'members/'.$page;
          $this->load->view('includes/template', $data);
        }else{
           // Call our custom 404 function
           show_404();
        }
    }
}

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class Someclass extends CI_Controller{

public function __construct(){

parent::__construct();

}

function view($page = ''){

if($member_page = file_exists(APPPATH . 'views/members/' . $page . '.php')){

$data['main_content'] = 'members/'.$page;

$this->load->view('includes/template', $data);

}else{

// Call our custom 404 function

show_404();

}

Enter an invalid URL and you should now see your new custom 404 page loaded in your template.

Custom 404 Page with Tempalte

Posted in Codeigniter, PHP | Comments Off

Codeigniter and Query Results MySQL Error 1064

Posted on October 21, 2012 by kylecoots

Although the title refers to Codeigniter this applies to anytime you run a query and get the MySQL Error 1064.

If your trying to Query results with MySQL and get and Error 1064 more than likely you forgot to escape something in your database results.

Take the following:

In Codeigniter you might run a query like this:

$email = 'email@snowballrandom.com';

$sql = "SELECT Email FROM Account WHERE Email = ".$email." ";
$query = $this->db->query($sql);
     if ($query->num_rows() > 0){
        foreach($query->result() as $row){
        echo $row->Email;
        }
     }

$email = 'email@snowballrandom.com';

$sql = "SELECT Email FROM Account WHERE Email = ".$email." ";

$query = $this->db->query($sql);

if ($query->num_rows() > 0){

foreach($query->result() as $row){

echo $row->Email;

}

Everything may look ok but in fact you forgot one importint thing! To escape the value you querying, the email address in this case.

Your code should look like this:

$email = 'email@snowballrandom.com';

$sql = "SELECT Email FROM Account WHERE Email = ".$this->db->escape($email)." ";
$query = $this->db->query($sql);
     if ($query->num_rows() > 0){
        foreach($query->result() as $row){
        echo $row->Email;
        }
     }

$email = 'email@snowballrandom.com';

$sql = "SELECT Email FROM Account WHERE Email = ".$this->db->escape($email)." ";

$query = $this->db->query($sql);

if ($query->num_rows() > 0){

foreach($query->result() as $row){

echo $row->Email;

}

Notice the “.$this->db->escape($email).” ? Granted this is a specific way to query for Codeigniter however, your query statement should always use an escaped value when dealing with emails or other strings that might need escaping.

An alternative way of escaping characters with Codeigniter is using bindings. Take the following for example:

  $name = 'Kyle';
  $email = 'email@snowballrandom.com';

  $sql = "SELECT Email FROM Account WHERE Email = ? ";
  $query = $this->db->query($sql, array($email, $name));
        if ($query->num_rows() > 0){
          foreach($query->result() as $row){
           echo $row->Email;   
          }
        }

$name = 'Kyle';

$email = 'email@snowballrandom.com';

$sql = "SELECT Email FROM Account WHERE Email = ? ";

$query = $this->db->query($sql, array($email, $name));

if ($query->num_rows() > 0){

foreach($query->result() as $row){

echo $row->Email;

}

Here we have used a question mark as a place holder and placed our values in an array. By doing this Codeigniter will automatically escape the values.

If your using something other than Codeigniter you can simply use the following:

mysql_real_escape_string(); Note: Use of this extension is discouraged.

Instead you should be using one of the following:

mysqli::real_escape_string();
or
php’s PDO_MYSQL

Posted in Codeigniter | Tagged Codeigniter, Error 1064, mysql, php | Comments Off

Installing No-IP 2 Ubuntu 12.04

Posted on October 9, 2012 by kylecoots

If your trying to install No-IP2 on Ubuntu 12.04, from source and get the error message “make: gcc: Command not found” or a similar message, you may not have the C++ Compiler installed.

“To install the gcc and g++ compilers, you will need the build-essential package. This will also install GNU make.

build-essential contains a list of packages which are essential for building Ubuntu packages including gcc compiler, make and other required tools.”

At the Terminal enter the following:

name@host:~/ sudo apt-get update
name@host:~/ sudo apt-get upgrade
name@host:~/ sudo apt-get install build-essential
name@host:~/ gcc -v
name@host:~/ make -v

name@host:~/ sudo apt-get update

name@host:~/ sudo apt-get upgrade

name@host:~/ sudo apt-get install build-essential

name@host:~/ gcc -v

name@host:~/ make -v

Now, you should able to compile software using C / C++ compilers.

Source quoted from Ubuntu Documentation. Find out more about compilers here: https://help.ubuntu.com/community/InstallingCompilers

Now your ready to install No-IP2 by entering the following:

name@host:~/ cd /usr/local/src 
//Or any directory you want to download the tar file to. i.e. /home/<Your Name>/downloads/
name@host:~/ wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz
name@host:~/ tar xzf noip-duc-linux.tar.gz
name@host:~/ cd no-ip-2.1.9
name@host:~/ make
name@host:~/ make install

name@host:~/ cd /usr/local/src

//Or any directory you want to download the tar file to. i.e. /home/<Your Name>/downloads/

name@host:~/ wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz

name@host:~/ tar xzf noip-duc-linux.tar.gz

name@host:~/ cd no-ip-2.1.9

name@host:~/ make

name@host:~/ make install

After that you should be prompted to enter your user name and password! That’s it, you should now be up and running with your No-IP DUC!

Posted in Daily Post | Tagged make: gcc: Command not found, No-ip, No-IP2, noip install, Ubuntu | Comments Off

New Webmin Look?

Posted on October 9, 2012 by kylecoots

I recently updated my webmin installation to 1.60 on didn’t notice any changes, however after I decided it was time for a fresh and well deserved re-install of the Ubuntu, I re-installed Webmin with the current version and after installing noticed a fresh and very clean look:

The New theme for Webmin

If your wondering you can still use the previous themes, by going to Webmin-> Webmin Configuration-> Webmin Themes and selecting one of the previous themes.

Suppose if I had checked prior to reinstalling the new theme would have been there, I just never thought to look… That will teach me!

Posted in Daily Post | Tagged Theme, Webmin | Comments Off

Codeigniter custom 404 page and show_404 function

Codeigniter and Query Results MySQL Error 1064

Installing No-IP 2 Ubuntu 12.04

New Webmin Look?

Categories

Recent Posts

Archives

Meta

Links

How to Remove FBI Moneypak Virus/Malware That Blocked PC Asks For Payment

Removing the actual FBI Moneypak Virus/ Malware Files

Conclusion / Final Thought

Codeigniter custom 404 page and show_404 function

Codeigniter and Query Results MySQL Error 1064

Installing No-IP 2 Ubuntu 12.04

New Webmin Look?

Categories

Recent Posts

Tags

Archives

Meta

Links