Recommended Posts

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

More info was at the bottom, including how much needed to be paid, etc. I did not include it.

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

why do you highly doubt it? I saw someone at work get the FBI scam one from a google image search, after clicking on the image it went right to that via an exploit (we think it was a java exploit)

I got hit with something similar on Houzz.com, and that is not a malware site, it's a pretty large house design site...

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

Command prompt.

Exactly. Every time I've seen this infection, it's never had anything to do with porn. </s> :rolleyes:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Command prompt.

LOLOLOLOL!!!!!! Too funny! :rofl:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

I just had this happen to a co-worker on a company laptop (it's a POS, but anyways) and ended up just doing a format/clean install (was quicker/easier) all (needed) docs and such were on the server (and if they weren't, lesson learned).

And that lesson was:

1) Use a better AV,

2) Disable Java

3) Backup anything not on the server

My brother guy the exact same one, he was so panicked it was hilarious, I made fun of him good for it, I suspect he got it from

using one of those websites that let you watch TV shows for free, and using a java exploit, so I removed the trojan and Java.

OP:

Take the time to make sure his PC is up to date, browsers updates, everything.

As for his browsers,

if he's using Firefox: Make sure to install AdBlock Plus, and NoScript.

if he's using Chrome: install Adblock, and Disconnect.

if he's using IE9/10: Install the FanBoy and EasyList adblocking TPLs. Also make sure that SmartScreen filter is running.

Should help him in the future. They'll prevent arbitrary code from running. Also make sure any and all unneeded addons are eliminated.

Also, if possible, remove him from the default administrator account. If he's going to keep calling you for help, just set yourself up as the administrator. Lol. It's what I did for my parents, and as annoying as it was for them, it worked. They couldn't run anything without my permission.

LOLOLOLOL!!!!!! Too funny! :rofl:

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

unpatched machine? you mean a patch for something like Java which DIDN'T have a patch out, and is something that is actually required in a lot of business environments at the browser level?..... please tell me how it could of been more pached then the latest patches out there by Oracle and Microsoft....

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

How the heck is arbitrary code running on a guest account?

How the heck is arbitrary code running on a guest account?

Beats me, I was surprised.

Edit: http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/800a69df-8312-4105-b70e-235500ab5421

Looks like viruses can still install on a guest account and run, but are not system wide and thus will not affect other users. This is how I was able to remove it. I ran Malwarebytes on the admin account.

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

of being a idiot. They must've had more dollars than sense.... now they have a little less... of both.

AND that's EXACTY the people they prey on. The uninformed/non-neowinian type (we all know better...right?)

i just removed this one from a friends laptop the other day. From what i could tell, it came from putlocker and/or skype, but could have other delivery methods. the girl that i removed it for actually thought it was real at first.

I don't see any identifying details even removed by yourself from the screen shot. How do you know details were stolen.

Sounds like a case of a parent who doesn't know enough about the Internet, trying to do something and not realising it's unsafe and giving away details.

Hello,

A fairly common scam/piece of malware, I've seen it called Win32/Reveton or simply "Moneypak." It displays fake "announcements" from various law enforcement agencies around the world. Here are a couple of articles about it:

I have heard of FBI (US), Garda (Ireland) and Metropolitan Police (UK) versions of this, but this is the first time I can recall hearing about an RCMP-specific version.

It is very likely your anti-malware/security vendor's technical support department is quite familiar with removing this, and can give additional instructions on securing the machine.

For example, one might want to check the hosts file on the computer and/or the DNS servers being used, in case they were involved in what looks like a redirection of Google's web site.

Regards,

Aryeh Goretsky

My Sister in laws friend has this aswell so it must be doing the rounds

there are lots of different versions of it for different Countrys

https://www.botnets....dex.php/Reveton

and also removal instructions

http://www.f-secure.com/v-descs/trojan_w32_reveton.shtml

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • How can it beat a Steam machine without a serious GPU? The two CU iGPU only provides about 5fps in gaming. That's not going to make any gamer happy.
    • Anthropic introduces Claude Tag, a new AI teammate for Slack by Fiza Ali Anthropic has announced Claude Tag, a new feature that lets teams work with Claude directly inside Slack. The idea is simple: once Claude is added to a Slack workspace and given access to selected channels, users can tag @Claude in conversations and assign tasks. Claude can then work through those requests using connected tools and data sources before posting its results back into a Slack thread. What makes Claude Tag different from a typical chatbot is that it's designed to operate as a shared assistant for an entire team rather than a single user. Everyone in a channel interacts with the same Claude instance. This allows the team members to see ongoing work and continue tasks started by others. Furthermore, Anthropic says the AI can build context over time by following conversations in channels where it has permission to operate. This means users don't have to repeatedly provide the same background information for every request. The system is also designed for asynchronous work. Instead of waiting for responses in a chat window, users can assign a task to Claude and return later once the work is complete. Anthropic says Claude can break larger requests into multiple steps and use connected tools to complete them. Moreover, the system can also schedule follow-up tasks and continue working on projects over extended periods. Another feature allows Claude to keep the users updated and follow up on unresolved tasks when its optional "ambient" mode is enabled. The company says the tool is already being used internally for software development, data analysis, support workflows, and debugging. According to Anthropic, around 65% of its product team's code is now generated through its internal version of Claude Tag. For organisations concerned about security, administrators can control which channels, tools, and data sources Claude can access. Separate Claude instances can also be configured for different departments, helping keep information isolated between teams. Administrators can also monitor activity logs, review completed tasks, and set spending limits at both the organisation and channel level. Claude Tag is now available in beta for Claude Enterprise and Claude Team customers and runs on Claude Opus 4.8 that was announced this May. The feature will also replace Anthropic's existing Claude in Slack application, with current users able to migrate within a 30-day migration window. Lastly, eligible customers will receive introductory credits to help teams evaluate the new experience.
    • Beats Studio Pro wireless over-ear ANC headphones drop to their lowest price yet by Fiza Ali Amazon is currently offering the Beats Studio Pro headphones at their all-time low price. The Studio Pro use 40mm active drivers which are designed to improve clarity and reduce distortion compared to previous models, with up to an 80% improvement over the Beats Studio3 Wireless. A built-in digital processor adjusts frequency response to keep the sound balanced rather than overly boosted in any one area. They also include Active Noise Cancelling that adapts to your surroundings to reduce background noise along with a Transparency mode that lets outside sound in when you need awareness of what’s going on around you. Furthermore, the headphones support personalised Spatial Audio with dynamic head tracking as well as Dolby Atmos playback on supported content. Moreover, built-in voice-targeting microphones improve call quality. You can also switch between three sound profiles including Beats Signature for balanced music playback, Entertainment for films and gaming, and Conversation for clearer voice in calls and podcasts. Physically, they are designed to be worn for long periods without feeling heavy or awkward. The ear cushions use UltraPlush engineered leather while metal sliders allow you to adjust the fit. On the connectivity side, the Studio Pro use Class 1 Bluetooth for a stable, long-range wireless connection. There is also a 3.5mm input if you want to plug in directly, including use with in-flight entertainment systems. Controls are located on the headphones and include a "b" button for music and call control, a volume rocker, and a multifunction button used for switching listening modes, EQ settings, power, and pairing. In addition, the headphones offer integration with both Apple and Android devices. On Apple devices, they support one-touch pairing with iCloud-linked devices, hands-free Siri access, Find My tracking based on last connected location, and automatic software updates. On Android devices, they support Google Fast Pair, Audio Switch between compatible devices, and Google Find My Device tracking, with additional features available through the Beats app. When it comes to the battery performance, it is rated at up to 40 hours of listening time with ANC turned off, and up to 24 hours with ANC or Transparency mode enabled. A 10-minute Fast Fuel charge should provide up to 4 hours of playback. Finally, the headphones use a rechargeable lithium-ion battery and charge via USB-C. Beats Studio Pro Wireless Over-Ear ANC Headphones: $149.95 (Amazon US) Good to know This Amazon deal is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
    • "lets you pause updates by choosing an end date, for up to 35 days" Wasn't it "indefinitely"?
    • Those extra reboots are related to the UEFI Secure Boot certificate update thing.
  • Recent Achievements

    • Rookie
      DaviKar went up a rank
      Rookie
    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      462
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      110
    4. 4
      Michael Scrip
      81
    5. 5
      Steven P.
      69
  • Tell a friend

    Love Neowin? Tell a friend!