Fedex Tracking Number Email Virus Removal Instructions (UPDATE)

“Fedex Tracking Number” Email Descriptions:

“Fedex Tracking Number” Email Virus or “Fedex Tracking Number” is another fraudulent email that circulates the web lately. The creator of this virus is getting more creative each time. “Fedex tracking number” email just pretends that it’s from fedex.com. No! It’s not! “Fedex Tracking Number” Email is malicious and dangerous. Do NOT open the attachments. This e-mail attachment contains a virus.

If you open the attachment, your computer will be infected. Simply delete it if you happen to see this email in your mailbox. What if you opened it already? Don’t panic. We have put together a simple removal instruction to take care of this. Be sure to stay away from this or remove it immediately if your computer is infected. Good luck!

Update: Here is the most recent version of the spam email message:

Please DO NOT open any attached files to that email! If you already clicked on the attachment we advise you to run a full scan with SpyHunter Malware Suite and detect if your PC is infected with FedEx tracking number email virus.

Manual Removal Instructions:

Stop “Fedex Tracking Number” Email Processes:
(Learn how to do this)
CbEvtSvc.exe
lphcjkrj0etfg.exe
phcjkrj0etfg.bmp
pphcjkrj0etfg.exe

Find and Delete these “Fedex Tracking Number” Email Files:
(Learn how to do this)
c:\Program Files\rhcnkrj0etfg
c:\Program Files\rhcnkrj0etfg\database.dat
c:\Program Files\rhcnkrj0etfg\license.txt
c:\Program Files\rhcnkrj0etfg\MFC71.dll
c:\Program Files\rhcnkrj0etfg\MFC71ENU.DLL
c:\Program Files\rhcnkrj0etfg\msvcp71.dll
c:\Program Files\rhcnkrj0etfg\msvcr71.dll
c:\Program Files\rhcnkrj0etfg\rhcnkrj0etfg.exe
c:\Program Files\rhcnkrj0etfg\rhcnkrj0etfg.exe.local
c:\Program Files\rhcnkrj0etfg\Uninstall.exe
c:\WINDOWS\system32\blphcjkrj0etfg.scr
c:\WINDOWS\system32\CbEvtSvc.exe
c:\WINDOWS\system32\lphcjkrj0etfg.exe
c:\WINDOWS\system32\phcjkrj0etfg.bmp
c:\WINDOWS\system32\pphcjkrj0etfg.exe
c:\WINDOWS\system32\drivers\54c70b2e.sys
c:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk
c:\Documents and Settings\LocalService\Application Data\rhcnkrj0etfg
c:\Documents and Settings\LocalService\Application Data\rhcnkrj0etfg\Quarantine

Remove “Fedex Tracking Number” Email Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\Software\Sysinternals\Bluescreen Screen Saver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcnkrj0etfg
HKEY_LOCAL_MACHINE\SOFTWARE\rhcnkrj0etfg

Tags:

By

Comments

  1. Jason says:

    When a coworker was infected, it immediately shut her computer down. She’s on a company network (3 people connected to a server with Win 2000 or possibly 2003), and it locked her out of her account. She can’t get back into the pc, even in safe mode. What can she do?

  2. Dee Anna says:

    This happened to my home computer yesterday. Husband opened email and clicked the link. I’m going to try and reboot tonight in safe mode – hope it works. When I logged in last night, it would just log back out. Went in BIOS and might try to boot from a recovery disk if none of these options work for me.
    Haven’t really seen anyone say they were not able to log back on, except you, so I’m also waiting for an answer.
    Good luck!

  3. Wilbur says:

    So what do you do when the virus has been allowed by an unwary loved one to run, has locked up your machine, and now you can’t log in at all to perform these recommended operations?

  4. Dee Anna says:

    I was able to login to Safe Mode, but it still logged me right back off. I guess I will try to boot from a Linux cd and see if that will work. If so, I’ll have to try and copy my files to it and start over -

  5. Michael Gordon says:

    I received the e-mail today. Upon opening the attached container (generated by The Bat! e-mail client) I saw a file with an .exe extension. I marked the e-mail as junk and deleted it, file and all.

  6. Sinu Sekhar says:

    Luckily I had the Free AVG Antivirus installed on my machine and it detected the virus and I moved it to Virus Vault immediately.

  7. Rob Gordon says:

    The Fedex email is going around now, my antivirus missed it on one computer, so I got caught. I have a copy of the email if anyone wants to analyze it for removal.

  8. Kylee says:

    My husband received it and actually expecting a package from Fed Ex he opened it. My antivirus overlooked it as well. So I downloaded the SpyHunter, it took an hour and two scans but it took it completly off! Thank you!

  9. hans says:

    this happened to me just now!i was expecting a package so i opened it. it locked down all my programs so i couldnt even open the “system restore” program. I restarted it, and and upon boot up, i chose the system restore there (where the safe modes are), and voila, it restored to my previous restore point few days ago. That was close!

  10. Hello,I like to find out more about this field. I appreciate you for publishing Fedex Tracking Number Email Virus Removal Instructions (UPDATE) | For XP/Vista.

  11. Wow! After all I got a website from where I be
    able to in fact get valuable information regarding my study and knowledge.

  12. Isn'tLifeGrand says:

    It’s back and bigger and badder than ever. I just ran Kaspersky Rescue Boot Disk and it did not find it the first time. Since I knew it was there I tried again, it did find it on the 2nd attempt and cleaned the PC up just fine. What a time of year to get this email. So many people will just click on it thinking that it is real. Like all emails, look at it closely and if it looks at all spooky, Just delete.

  13. Jessica says:

    I opened the email and tried to download the file numerous times but nothing would pop up My computer was fine I havnt had any problems It didn’t lock me out or seem to have any affect at all. Should I be worried???

  14. AFry says:

    As with Jason, I was successful in removing it partially with a malwarebytes scan in safe mode. Tried a full scan in regular mode and it captured 3 before completely shutting down my laptop. Now it will not so much as turn on!!! HELP!!!

  15. HELP says:

    How am I supposed to get rid of the virus if I can’t even get onto the Internet? I don’t have a system restore check point either. This virus is on my work computer, & I’m freaking out. I CAN’T restore the computer from scratch, because I’ll lose everything.

  16. I am writing you on a desktop computer as my laptop appears to have acquired a virus (I am not sure if it falls in the category of the Fedex tracking number type you describe but akin to it) under these circumstances. It seems that Fedex is being used as a malicious “come on” in selling the security software called the Security Defender. I receied an email from Fedex, apparently legitimate with your logo, informing me of an undelivered parcel that I have to pick up at the nearest Fedex office; I needed to click the portion in the email marked “Receipt” and print the document to collect the parcel. Clicking “Receipt” led to downloading the sale of the Defender software and no matter what I do to refuse the purchase I am not interested in, the sale screen with notes of upgrade, full version, etc. stays on. I cannot find a way of deleting the screen and worst of all, it turned out later that I am unable to open any program without the screen preventing its access. The purchase screen even blocks the “add and remove” portion of the laptop’s control panel. Now my laptop is nonusable.
    What a dirty way to do business; there must be a way to stop this method. (I wanted to attach a copy of the email I received but ,unfortunately, I have no way to do it here.)

  17. Gene says:

    Yes I have the same problem as Leonardo Paulino. It blocks pretty much any task you try to start. Help!!! This is the latest version I suppose.

  18. manwich9742 says:

    I opened things on my android phone. I haven’t experienced anything yet, but what can i do to ensure my phone won’t get ruined?

Speak Your Mind

*