Recommended Posts

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

More info was at the bottom, including how much needed to be paid, etc. I did not include it.

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

why do you highly doubt it? I saw someone at work get the FBI scam one from a google image search, after clicking on the image it went right to that via an exploit (we think it was a java exploit)

I got hit with something similar on Houzz.com, and that is not a malware site, it's a pretty large house design site...

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

Command prompt.

Exactly. Every time I've seen this infection, it's never had anything to do with porn. </s> :rolleyes:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Command prompt.

LOLOLOLOL!!!!!! Too funny! :rofl:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

I just had this happen to a co-worker on a company laptop (it's a POS, but anyways) and ended up just doing a format/clean install (was quicker/easier) all (needed) docs and such were on the server (and if they weren't, lesson learned).

And that lesson was:

1) Use a better AV,

2) Disable Java

3) Backup anything not on the server

My brother guy the exact same one, he was so panicked it was hilarious, I made fun of him good for it, I suspect he got it from

using one of those websites that let you watch TV shows for free, and using a java exploit, so I removed the trojan and Java.

OP:

Take the time to make sure his PC is up to date, browsers updates, everything.

As for his browsers,

if he's using Firefox: Make sure to install AdBlock Plus, and NoScript.

if he's using Chrome: install Adblock, and Disconnect.

if he's using IE9/10: Install the FanBoy and EasyList adblocking TPLs. Also make sure that SmartScreen filter is running.

Should help him in the future. They'll prevent arbitrary code from running. Also make sure any and all unneeded addons are eliminated.

Also, if possible, remove him from the default administrator account. If he's going to keep calling you for help, just set yourself up as the administrator. Lol. It's what I did for my parents, and as annoying as it was for them, it worked. They couldn't run anything without my permission.

LOLOLOLOL!!!!!! Too funny! :rofl:

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

unpatched machine? you mean a patch for something like Java which DIDN'T have a patch out, and is something that is actually required in a lot of business environments at the browser level?..... please tell me how it could of been more pached then the latest patches out there by Oracle and Microsoft....

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

How the heck is arbitrary code running on a guest account?

How the heck is arbitrary code running on a guest account?

Beats me, I was surprised.

Edit: http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/800a69df-8312-4105-b70e-235500ab5421

Looks like viruses can still install on a guest account and run, but are not system wide and thus will not affect other users. This is how I was able to remove it. I ran Malwarebytes on the admin account.

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

of being a idiot. They must've had more dollars than sense.... now they have a little less... of both.

AND that's EXACTY the people they prey on. The uninformed/non-neowinian type (we all know better...right?)

i just removed this one from a friends laptop the other day. From what i could tell, it came from putlocker and/or skype, but could have other delivery methods. the girl that i removed it for actually thought it was real at first.

I don't see any identifying details even removed by yourself from the screen shot. How do you know details were stolen.

Sounds like a case of a parent who doesn't know enough about the Internet, trying to do something and not realising it's unsafe and giving away details.

Hello,

A fairly common scam/piece of malware, I've seen it called Win32/Reveton or simply "Moneypak." It displays fake "announcements" from various law enforcement agencies around the world. Here are a couple of articles about it:

I have heard of FBI (US), Garda (Ireland) and Metropolitan Police (UK) versions of this, but this is the first time I can recall hearing about an RCMP-specific version.

It is very likely your anti-malware/security vendor's technical support department is quite familiar with removing this, and can give additional instructions on securing the machine.

For example, one might want to check the hosts file on the computer and/or the DNS servers being used, in case they were involved in what looks like a redirection of Google's web site.

Regards,

Aryeh Goretsky

My Sister in laws friend has this aswell so it must be doing the rounds

there are lots of different versions of it for different Countrys

https://www.botnets....dex.php/Reveton

and also removal instructions

http://www.f-secure.com/v-descs/trojan_w32_reveton.shtml

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • "lets you pause updates by choosing an end date, for up to 35 days" Wasn't it "indefinitely"?
    • Those extra reboots are related to the UEFI Secure Boot certificate update thing.
    • Hands on with the ProtoArc EM25: Affordable ergonomic mouse that focuses on the right things by Taras Buria ProtoArc is known for making all sorts of office products with a big focus on ergonomics and comfort. Its latest product, the EM25, promises a comfortable-to-use, affordable, and customizable mouse. We took one for a spin; here are our impressions. The ProtoArc EM25 is a $49.99 mouse, but right now, during Prime Day 2026, you can get it for just $37.99. Right off the bat, you can see that the EM25 is inspired by Logitech's MX Master lineup and the legendary MX Master 3/3S. Its shape and proportions are very similar, so for a person with large hands (right-handed person, mind you), the EM25 is very comfortable to use. The mouse fills the palm, and the thumb rests on a small extension, giving your wrist a small tilt to reduce strain. The mouse is made of black plastic without any coating, eliminating long-term wear concerns. However, I can see the main buttons and other areas you touch the most getting polished over time. Despite its size and bulk, the mouse is not too heavy. It weighs about 100 grams, which is significantly less than the MX Master 3S and its successor. It is no lightweight gaming mouse by any means, but it is not excessively heavy like the MX Master 4. The EM25 has a built-in storage for its USB dongle. It is a cleverly made magnetic flap that you open by simply pressing on it. Next to the flap, you will find the on/off switch, the 1,000 Hz sensor, and a DPI button (up to 8,000 DPI). I find the DPI button location a bit odd, and I would prefer it somewhere below the main scroll wheel. Still, given that I never change DPI on my mice, I will let it pass. What is more important is that, unlike MX Master 3/3S/4, the device switch button is located below the left-click button, which allows you to switch devices without lifting and flipping the mouse. For a multi-device setup, this is a perfect solution: the button does not require too much effort to use, it does not get in your way, but it is also easily reachable with your thumb. The main scroll wheel has two modes: ratcheted and free-flow. You can only change between them with a bright orange button (I like this little touch of color), which is sprung and requires some effort to press. The wheel is dead-silent in free-flow mode, but ratched is quite loud and stiff, perhaps even too much to my liking. I can hardly call it deal-breaking, but it will certainly take some time to get used to. The side scroll wheel, it is notched, silent, and pleasant to use. Next to it, you can find a piece of glossed plastic with connection indicators: Dongle, Bluetooth 1, Bluetooth 2, and the low battery indicator. By the way, the built-in battery is rechargeable via a USB Type-C cable, which is included. It is sleeved and has an orange velcro strap to keep it tidy. After using the EM25 for a few weeks, I can say that its main buttons are my absolute favorite. They have very pronounced clicks, which feel great with just the right amount of force required to register a press. I would say they feel like something in between regular mouse clicks and silent ones. You can hear and feel the springy switch, but it is not sharp or loud to the point of annoying you. As for back/forward and device switch buttons, they are very clicky and quite noisy. Unfortunately, there are no extra buttons that you can map to specific things like in the MX Master lineup. Besides great primary clicks, another thing I like about the EM25 is its 1,000 Hz sensor. In the world, where Logitech still uses 125 Hz sensors in $100+ mice, seeing a much faster sensor in a mouse that costs three times less is very refreshing. Also, all the settings and customization you make are stored on-device, and you do not need to install any software. Just open the web-based app and change all that you need. Speaking of customization, you can remap what buttons do, adjust the DPI, and the sensor speed. Sadly, gestures are not supported, but you can still map pretty much anything to each button, including shortcuts, media buttons, and more. I also recommend using software like XMouseControl, as it will let you remap the side scroll wheel. At the end of the day, the ProtoArc EM25 is a great mouse. Clearly inspired by the MX Master lineup, it takes the best of it and complements it with a much more wallet-friendly price tag, significantly better sensor, on-device memory, a built-in storage for the dongle, and more (it fixes everything that I complained about the MX Master 4 recently). And for only $37.99 during Prime Day, the EM25 is an easy recommendation. Buy ProtoArc EM25 mouse - $37.99 | 24% off with Prime As an Amazon Associate, we earn from qualifying purchases.
    • Pretty nice tool, thanks
  • Recent Achievements

    • Rookie
      DaviKar went up a rank
      Rookie
    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      464
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      110
    4. 4
      Michael Scrip
      83
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!