Recommended Posts

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

More info was at the bottom, including how much needed to be paid, etc. I did not include it.

In the screenshot I didn't see where the SSN/SIC number was mentioned or blocked out, just a IP and City.

And curious minds want to know what the RCMP used to "check" the computer. Malwarebytes (pro or free version)?

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

why do you highly doubt it? I saw someone at work get the FBI scam one from a google image search, after clicking on the image it went right to that via an exploit (we think it was a java exploit)

I got hit with something similar on Houzz.com, and that is not a malware site, it's a pretty large house design site...

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

I'd like to know the name of this supposed "dos" program, considering Windows hasn't used "dos" since....forever ago.

sounds like "drive by downloads", usually happens because a machine is not fully patched. ;)

Command prompt.

Exactly. Every time I've seen this infection, it's never had anything to do with porn. </s> :rolleyes:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Command prompt.

LOLOLOLOL!!!!!! Too funny! :rofl:

you can get this crap from infected sites that aren't porn, Houzz.com definatly isn't a porn site, and I got hit by it there..... our local newspaper got hit thanks to one of their stupid ad providers..... anyone who went to the paper site got something similar....

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

I just had this happen to a co-worker on a company laptop (it's a POS, but anyways) and ended up just doing a format/clean install (was quicker/easier) all (needed) docs and such were on the server (and if they weren't, lesson learned).

And that lesson was:

1) Use a better AV,

2) Disable Java

3) Backup anything not on the server

My brother guy the exact same one, he was so panicked it was hilarious, I made fun of him good for it, I suspect he got it from

using one of those websites that let you watch TV shows for free, and using a java exploit, so I removed the trojan and Java.

OP:

Take the time to make sure his PC is up to date, browsers updates, everything.

As for his browsers,

if he's using Firefox: Make sure to install AdBlock Plus, and NoScript.

if he's using Chrome: install Adblock, and Disconnect.

if he's using IE9/10: Install the FanBoy and EasyList adblocking TPLs. Also make sure that SmartScreen filter is running.

Should help him in the future. They'll prevent arbitrary code from running. Also make sure any and all unneeded addons are eliminated.

Also, if possible, remove him from the default administrator account. If he's going to keep calling you for help, just set yourself up as the administrator. Lol. It's what I did for my parents, and as annoying as it was for them, it worked. They couldn't run anything without my permission.

LOLOLOLOL!!!!!! Too funny! :rofl:

Yeah, a drive by download....which happens to unpatched machines. Not my first time dealing with them. PatchMyPC(dot)net. Sure does help! ;)

unpatched machine? you mean a patch for something like Java which DIDN'T have a patch out, and is something that is actually required in a lot of business environments at the browser level?..... please tell me how it could of been more pached then the latest patches out there by Oracle and Microsoft....

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

I just finished removing the virus using Malwarebytes. 117 Infections in total. Oy. Machine was Windows 7 fully patched. I ran the updates 2 days ago. I will be installing Win8 this weekend. Oh, and he was using a Guest Account named Family. Not an administrator account.

How the heck is arbitrary code running on a guest account?

How the heck is arbitrary code running on a guest account?

Beats me, I was surprised.

Edit: http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/800a69df-8312-4105-b70e-235500ab5421

Looks like viruses can still install on a guest account and run, but are not system wide and thus will not affect other users. This is how I was able to remove it. I ran Malwarebytes on the admin account.

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

Someone I work with got the FBI one, and, wait for it, she PAID IT!!!! She came to work talking about how the FBI made her pay $300 for "something" or they wouldn't unlock her computer. We could not believe how stupid that was. Obviously she or her spouse is a little guilty of something...

of being a idiot. They must've had more dollars than sense.... now they have a little less... of both.

AND that's EXACTY the people they prey on. The uninformed/non-neowinian type (we all know better...right?)

i just removed this one from a friends laptop the other day. From what i could tell, it came from putlocker and/or skype, but could have other delivery methods. the girl that i removed it for actually thought it was real at first.

I don't see any identifying details even removed by yourself from the screen shot. How do you know details were stolen.

Sounds like a case of a parent who doesn't know enough about the Internet, trying to do something and not realising it's unsafe and giving away details.

Hello,

A fairly common scam/piece of malware, I've seen it called Win32/Reveton or simply "Moneypak." It displays fake "announcements" from various law enforcement agencies around the world. Here are a couple of articles about it:

I have heard of FBI (US), Garda (Ireland) and Metropolitan Police (UK) versions of this, but this is the first time I can recall hearing about an RCMP-specific version.

It is very likely your anti-malware/security vendor's technical support department is quite familiar with removing this, and can give additional instructions on securing the machine.

For example, one might want to check the hosts file on the computer and/or the DNS servers being used, in case they were involved in what looks like a redirection of Google's web site.

Regards,

Aryeh Goretsky

My Sister in laws friend has this aswell so it must be doing the rounds

there are lots of different versions of it for different Countrys

https://www.botnets....dex.php/Reveton

and also removal instructions

http://www.f-secure.com/v-descs/trojan_w32_reveton.shtml

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Google begins rolling out its post-Epic Play Store billing model next week by Karthik Mudaliar Google has confirmed that its redesigned Play Store billing and fee structure will take effect on June 30, 2026, in the United States, the United Kingdom, and the European Economic Area. The changes will let eligible developers offer their own payment systems or send users to an external website for purchases, while separating Google’s platform service fee from the cost of using Google Play Billing. The rollout puts concrete dates and detailed rate cards behind the broader Android policy overhaul Google announced in March. That announcement followed a proposed settlement with Epic Games intended to resolve their long-running disputes over app distribution and payments, although the U.S. portion of the agreement still requires court approval. Under the new billing choice program, developers selling digital content or services can display an alternative payment option alongside Google Play Billing. They may also direct users to their own websites to complete a purchase. Developers can use Google’s standard payment-choice screen or design one that complies with the company’s user-interface rules. Choosing another payment processor does not eliminate Google’s cut altogether. The company will continue charging a service fee for transactions associated with apps distributed through Google Play, regardless of whether payment is handled by Google, an alternative provider, or a developer’s website. Google argues that this fee covers the value and infrastructure provided by Android and the Play Store. For developers earning up to $1 million annually, the service fee will generally be 10 percent. That rate also applies to auto-renewing subscriptions. When Google Play Billing is used in the U.S., U.K., or EEA, Google will add a separate 5 percent billing fee, and developers processing payments elsewhere will not pay that additional charge. This means Google’s familiar flat 30 percent commission is disappearing, but developers will not necessarily see a dramatic reduction on every transaction. An in-app purchase from an existing user processed through Google Play Billing can still reach a combined 30 percent. The biggest savings are likely to come from subscriptions, smaller developers covered by the $1 million tier, and companies able to move customers to their own payment infrastructure. Google is also offering lower rates through its Apps Experience and revamped Games Level Up programs. Apps and games that satisfy the company’s requirements can qualify for 15 percent service fees on new-install transactions and 20 percent on existing-install transactions. The criteria include performance and reliability standards, support for additional Android device categories, and selected platform features. Those program rates are scheduled to become available in the initial markets and Australia on September 30. For consumers, the immediate effect will depend on whether developers adopt alternative payments and pass any savings on through lower prices. For developers, however, June 30 begins a more flexible but considerably more complicated Play Store economy in which distribution, billing, install dates, revenue thresholds, and program participation can each affect Google’s final cut. Google is also separately developing a Registered App Stores program designed to simplify the installation of qualifying third-party stores. That initiative is expected to arrive with a major Android release later in 2026 and will launch outside the U.S. first. Google says the rest of the world will receive the changes by September 30, 2027, although billing rates for markets outside the US, UK, and EEA have not yet been announced.
    • 38% off a super insane price is still an INSANE price.
    • 1TB Samsung T9 and Samsung 9100 PRO SSDs are now selling at great prices by Fiza Ali Amazon is now offering the 1TB variant of Samsung T9 and Samsung 9100 PRO SSD at great prices with limited-time 38% and 39% discounts, respectively, so you may want to check them out if you have been looking to upgrade your storage solution. The Samsung T9 connects via a USB 3.2 Gen 2x2 (20Gbps) interface and delivers sequential read speeds of up to 2,000MB/s and sequential write speeds of up to 1,950MB/s, making it suitable for transferring large files, backing up data, and handling high-resolution media content. When it comes to the security features, the SSD includes AES 256-bit hardware encryption to help protect sensitive data. Designed for portability, the drive is reportedly resistant to drops from heights of up to 3 metres. Furthermore, it operates within a temperature range of 0°C to 60°C and can be stored at temperatures between -40°C and 85°C. Samsung Magician Software is included for drive management, firmware updates, performance optimisation, and health monitoring. Finally, the T9 is certified to multiple international standards, including CE, FCC, UL, UKCA, and RoHS 2 compliance, and is backed by a five-year limited warranty as well. 1TB Samsung T9 SSD: $179.99 (Amazon US) - 38% off The Samsung 9100 PRO uses the M.2 2280 form factor and connects through a PCIe 5.0 x4 interface with NVMe 2.0 support. Built with Samsung V-NAND TLC flash memory, an in-house controller, and 1GB of low-power DDR4X cache memory, the 9100 PRO is engineered for high-performance computing and gaming workloads. Furthermore, the SSD delivers sequential read speeds of up to 14,700MB/s and sequential write speeds of up to 13,300MB/s. Random performance is rated at up to 1,850,000 IOPS for reads and up to 2,600,000 IOPS for writes, depending on system hardware and configuration. The drive supports TRIM, S.M.A.R.T monitoring, automatic garbage collection, and device sleep mode to help maintain performance and efficiency over time. In terms of security features, it includes AES 256-bit encryption, TCG Opal support, and IEEE 1667 compliance. The 9100 PRO operates within a temperature range of 0°C to 70°C, is rated for 1.5 million hours MTBF, and can reportedly withstand shocks of up to 1,500G for 0.5 milliseconds. Finally, Samsung Magician Software is also included for firmware updates, performance monitoring, drive management, and optimisation. 1TB Samsung 9100 PRO SSD: $206.99 (Amazon US) - 39% off Alternatively, you can also check out other SSD deals here. Good to know This Amazon deal is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
    • This is about the already discredited 2025 announcement. Not the current one, which I've heard nothing negative about in the academic literature.
  • Recent Achievements

    • Dedicated
      Scoobystu earned a badge
      Dedicated
    • First Post
      Tom Schmidt earned a badge
      First Post
    • One Month Later
      D0nn13 earned a badge
      One Month Later
    • Rookie
      +ChiefOfNeo went up a rank
      Rookie
    • One Year In
      Tom Schmidt earned a badge
      One Year In
  • Popular Contributors

    1. 1
      +primortal
      464
    2. 2
      +Edouard
      177
    3. 3
      PsYcHoKiLLa
      124
    4. 4
      Michael Scrip
      81
    5. 5
      Xenon
      76
  • Tell a friend

    Love Neowin? Tell a friend!