Recommended Posts

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

More info was at the bottom, including how much needed to be paid, etc. I did not include it.

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

why do you highly doubt it? I saw someone at work get the FBI scam one from a google image search, after clicking on the image it went right to that via an exploit (we think it was a java exploit)

I got hit with something similar on Houzz.com, and that is not a malware site, it's a pretty large house design site...

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

Command prompt.

Exactly. Every time I've seen this infection, it's never had anything to do with porn. </s> :rolleyes:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Command prompt.

LOLOLOLOL!!!!!! Too funny! :rofl:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

I just had this happen to a co-worker on a company laptop (it's a POS, but anyways) and ended up just doing a format/clean install (was quicker/easier) all (needed) docs and such were on the server (and if they weren't, lesson learned).

And that lesson was:

1) Use a better AV,

2) Disable Java

3) Backup anything not on the server

My brother guy the exact same one, he was so panicked it was hilarious, I made fun of him good for it, I suspect he got it from

using one of those websites that let you watch TV shows for free, and using a java exploit, so I removed the trojan and Java.

OP:

Take the time to make sure his PC is up to date, browsers updates, everything.

As for his browsers,

if he's using Firefox: Make sure to install AdBlock Plus, and NoScript.

if he's using Chrome: install Adblock, and Disconnect.

if he's using IE9/10: Install the FanBoy and EasyList adblocking TPLs. Also make sure that SmartScreen filter is running.

Should help him in the future. They'll prevent arbitrary code from running. Also make sure any and all unneeded addons are eliminated.

Also, if possible, remove him from the default administrator account. If he's going to keep calling you for help, just set yourself up as the administrator. Lol. It's what I did for my parents, and as annoying as it was for them, it worked. They couldn't run anything without my permission.

LOLOLOLOL!!!!!! Too funny! :rofl:

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

unpatched machine? you mean a patch for something like Java which DIDN'T have a patch out, and is something that is actually required in a lot of business environments at the browser level?..... please tell me how it could of been more pached then the latest patches out there by Oracle and Microsoft....

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

How the heck is arbitrary code running on a guest account?

How the heck is arbitrary code running on a guest account?

Beats me, I was surprised.

Edit: http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/800a69df-8312-4105-b70e-235500ab5421

Looks like viruses can still install on a guest account and run, but are not system wide and thus will not affect other users. This is how I was able to remove it. I ran Malwarebytes on the admin account.

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

of being a idiot. They must've had more dollars than sense.... now they have a little less... of both.

AND that's EXACTY the people they prey on. The uninformed/non-neowinian type (we all know better...right?)

i just removed this one from a friends laptop the other day. From what i could tell, it came from putlocker and/or skype, but could have other delivery methods. the girl that i removed it for actually thought it was real at first.

I don't see any identifying details even removed by yourself from the screen shot. How do you know details were stolen.

Sounds like a case of a parent who doesn't know enough about the Internet, trying to do something and not realising it's unsafe and giving away details.

Hello,

A fairly common scam/piece of malware, I've seen it called Win32/Reveton or simply "Moneypak." It displays fake "announcements" from various law enforcement agencies around the world. Here are a couple of articles about it:

I have heard of FBI (US), Garda (Ireland) and Metropolitan Police (UK) versions of this, but this is the first time I can recall hearing about an RCMP-specific version.

It is very likely your anti-malware/security vendor's technical support department is quite familiar with removing this, and can give additional instructions on securing the machine.

For example, one might want to check the hosts file on the computer and/or the DNS servers being used, in case they were involved in what looks like a redirection of Google's web site.

Regards,

Aryeh Goretsky

My Sister in laws friend has this aswell so it must be doing the rounds

there are lots of different versions of it for different Countrys

https://www.botnets....dex.php/Reveton

and also removal instructions

http://www.f-secure.com/v-descs/trojan_w32_reveton.shtml

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • If Valve refused to let them make the case, I wonder if they've already partnered with someone else to do it? The fact that they didn't seek permission/licence before diving straight in is incredible though
    • OpenClaw now has native mobile apps on iOS and Android by Karthik Mudaliar OpenClaw, the viral open-source personal AI agent, now has its own mobile app, available on both Android and iOS. Users can pair the app with an existing OpenClaw gateway and can start using new mobile-native features that are now available on the app. The app supports all the existing features you'd already have seen on OpenClaw's TUI, as well as some more, such as real-time and background Talk mode, action approvals, sharing from iOS, and optional access to device capabilities such as camera, screen, location, photos, contacts, calendar, and reminders. These features are available on both the Android and iOS versions of the app. What's important with these apps is that they don't run OpenClaw on your phone, but are actually just companion apps that require a running OpenClaw Gateway on an existing device, on macOS, Linux, or Windows via WSL2. To pair the app with your existing OpenClaw gateway, users need to run the command "/pair qr" on the TUI or existing chat interface, which brings up a QR code. Users can then scan this QR code to pair it up with the mobile app. There's also an option to manually pair the app by entering the host and a port. Previously, OpenClaw had been available on phones via WhatsApp, Telegram, Slack, Discord, Microsoft Teams, Matrix, and others. Now, with a native mobile app, the interface is much cleaner and more focused on just the OpenClaw, of course, with the added support for camera, screen, location, and more. It's important to note that OpenClaw comes with its own security warnings. There's always a chance of prompt injection with these tools, so users are recommended to double-check authentication, tool policy, sandboxing, and execution approvals rather than prompts alone. For users well-versed with the AI harness, a native mobile app makes it easier to approve an automation, share a link, use voice, or let an agent react to phone-side context.
    • Google pitches Spanner as one database for all AI agents with these new featues by Karthik Mudaliar Google Cloud is introducing new features within Spanner, its distributed database, as a place where enterprises should keep their data, using which AI agents could make smarter and better decisions. In a detailed blog post, Google highlighted quite a few features coming to Spanner, including relational data, graph relationships, vector search, key-value access, full-text search, and operational analytics together in one database architecture. Google says that today's systems aren't well-made for AI agents. There could be data that is present in one system, search indexes in another, embeddings in a vector database, and relationship data in a graph database. This fragmentation isn't great for AI agents to do their jobs because they don't have access to all of this data in one place. This is where Google is positioning Spanner as a solution. Spanner is already a globally distributed relational database with strong consistency, and Google wants its customers to see it as a broader data layer for AI applications. The company introduced something called Spanner Graph, along with integrated vector search, full-text search, a Cassandra-compatible key-value endpoint, and a columnar engine for analytical queries on operational data. Google also added that its ScaNN-powered vector search can support indexes with more than 10 billion vectors, while the columnar engine can make some analytical scans up to 200 times faster. All of this isn't just exclusive to the Google Cloud Platform, and there's support for multi-cloud as well. This comes via Spanner Omni, which Google says is a downloadable, containerized version of Spanner that can run on Kubernetes and in environments outside Google Cloud, including Microsoft Azure and AWS, and even on-premises infrastructure as well as edge deployments. Google says that customers who are interested in the full-featured edition should contact the company, and there's no word on commercial availability or separate pricing. Those interested can read the full blog by Google Cloud, which details these features individually.
    • Kalmuri 4.2.5 by Razvan Serea Kalmuri is your all-in-one, portable screen capture and recording solution designed for speed, simplicity, and flexibility. Whether you need a full-screen snapshot, a custom area, a scrolling webpage, or smooth video recording, Kalmuri delivers with ease. Capture text instantly from images with built-in OCR, keep floating images on top for quick reference, and use the precise color picker for perfect design matching. Customize hotkeys to work your way and share results instantly with built-in upload options. Kalmuri runs without installation, making it ideal for USB use, and offers an intuitive interface that’s easy to learn. Kalmuri key features: Video recording support (designation of whole screen and area) Whole screen, active program, window control, area application Extract text from images using optical character recognition (OCR). Support for PNG, JPG, WEBP, BMP, GIF file formats MP4 video recording powered by FFmpeg for high-quality results Full web page capture Share the captured image on the web Color extraction function Printer output Hotkey settings Adjustable via keyboard for area capture (Arrow key, Ctrl+Arrow key, Shift+Arrow key) File name format (sequential, datetime) Free to use it at work, at home, in government offices, at school, etc. Using Kalmuri portable for video recording Kalmuri’s portable version doesn’t include FFmpeg, which is required for video recording. Without it, you’ll get an “error FFmpeg.exe not found” message. To fix this, download FFmpeg from the provided link, extract it, and place FFmpeg.exe in Kalmuri’s folder. Kalmuri will then recognize it automatically, allowing you to start recording in high quality instantly. Kalmuri 4.2.5 changelog: Fixed an intermittent crash when using Area Capture Improved stability for Area Capture and screen recording Resolved a capture issue that could occur right after startup Download: Kalmuri 4.2.5 | 24.2 MB (Freeware) Download: Kalmuri Portable 4.2.5 | 2.1 MB View: Kalmuri Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • First Post
      rosiecharles earned a badge
      First Post
    • Reacting Well
      Juan Dela earned a badge
      Reacting Well
    • Week One Done
      Collagen Project earned a badge
      Week One Done
    • Reacting Well
      Wakeen1966 earned a badge
      Reacting Well
    • Rookie
      Almohandis went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      516
    2. 2
      +Edouard
      273
    3. 3
      PsYcHoKiLLa
      143
    4. 4
      Steven P.
      98
    5. 5
      macoman
      54
  • Tell a friend

    Love Neowin? Tell a friend!