Recommended Posts

German federal police are warning about a computer virus that accuses victims of viewing "juvenile pornography".

It also displays an image that it claims reveals images of child sexual abuse have been viewed on a computer.

The Windows virus locks a computer and only returns control to its owner on payment of a 100 euro (?86) fine.

It purports to be collecting cash on behalf of German copyright authorities and the country's national computer security agency.

The virus amounted to "digital extortion" and victims should not pay up, said German police.

The warning about the novel strain of ransomware was issued by Germany's Federal Criminal police office (the Bundeskriminalamt or BKA).

The ransomware version found by the BKA uses a pop-up window that says the machine has been locked down due to "unauthorised network activity". The window is crafted to look like it has been put together by Germany's Federal Office for Information Security (BKI) and its society for prosecution of copyright infringement (GVU).

Text in the window claims that images of child sexual abuse as well as pirated content have been found on the machine. Also displayed is an picture of a child which it claims reveals illegal images have been viewed.

Rik Ferguson, director of security research at Trend Micro, said it was the first time he had heard of ransomware displaying images that users were accused of harbouring.

more

Link to comment
https://www.neowin.net/forum/topic/1134258-beware-of-child-porn-computer-virus/
Share on other sites

This is not anything new. It's actually extremely easy to clean out also. The problem with this attack and other variants is that there is a very high likelyhood that saved credentials are being stolen (log on and credit info from websites). If anyone needs help cleaning you can send me a PM but really there are tons of tools that will do it for you, what you should be concerned about is your information.

yea ive also had to fix quite a few computers over the last few months with this one. It does a pretty good job at completely locking out the victim though, so I could see why it scares people, pretty much nothing works short of rebooting into safemode, from there its easy, but it for sure gives people a good scare.

Yeah, a friend of mine got something similar last week. Took only a few minutes to clean but he was terrified. Thought his computer was full of viruses and he was going to have to pay to fix it.

So how did you fix it ?

I will beware of child porn from here on out!! Thanks for the warning. That was close. Too close... :s

I don't think people were visiting poRn sites at all -- but other questionable warez/pirate sites.

Here's an interesting article on ransomware:

http://blogs.technet.com/b/markrussinovich/archive/2013/01/07/3543763.aspx

^ Is rkill part of Windows 7 Defender ... ?

I've always started the Task Manager as fast as possible, saw and stopped the bad process, then Deleted the .exe proggy.

Symantec provides a free tool, Norton Power Eraser, that seeks out and destroys ransomware and other forms of "scareware," like fake antivirus software.

I do not go to such sites so I am not worried.

I don't think people were visiting poRn sites at all -- but other questionable warez/pirate sites.

This is just typical everyday virus stuff - nothing really new other than maybe the kiddie p0rn aspect of it, which is not really funny at all.

But these statements caught my eye - have you read cisco's report?

------

http://www.cisco.com/en/US/prod/vpndevc/2013-annual-security-report.pdf

The general belief is that sites that promote criminal activity?such as sites selling illegal pharmaceuticals or counterfeit luxury goods?are most likely to host malware. Our data reveals the truth of this outdated notion, as Web malware encounters are typically not the by-product of ?bad? sites in today?s threat landscape.

As Cisco data shows, the notion that malware infections most commonly result from ?risky? sites such as counterfeit software is a misconception. Cisco?s analysis indicates that the vast majority of web malware encounters actually occur via legitimate browsing of mainstream websites. In other words, the majority of encounters happen in the places that online users visit the most?and think are safe.

Holding the second spot on the list are online advertisements, comprising 16 percent of total web malware encounters. Syndicated advertising is a common means of monetizing websites, so a single malicious ad distributed in this manner can have a dramatic, adverse impact.

--------

This is just typical everyday virus stuff - nothing really new other than maybe the kiddie p0rn aspect of it, which is not really funny at all.

But these statements caught my eye - have you read cisco's report?

------

http://www.cisco.com...rity-report.pdf

The general belief is that sites that promote criminal activity?such as sites selling illegal pharmaceuticals or counterfeit luxury goods?are most likely to host malware. Our data reveals the truth of this outdated notion, as Web malware encounters are typically not the by-product of ?bad? sites in today?s threat landscape.

As Cisco data shows, the notion that malware infections most commonly result from ?risky? sites such as counterfeit software is a misconception. Cisco?s analysis indicates that the vast majority of web malware encounters actually occur via legitimate browsing of mainstream websites. In other words, the majority of encounters happen in the places that online users visit the most?and think are safe.

Holding the second spot on the list are online advertisements, comprising 16 percent of total web malware encounters. Syndicated advertising is a common means of monetizing websites, so a single malicious ad distributed in this manner can have a dramatic, adverse impact.

--------

Exactly!

I went down to my competitors office to see if he had some really old sdram for an old laptop. While I was there I asked him "Have you been seeing very many infections caused my java?"

I asked him this because I always got the feeling from talking to him that he doesn't know java is a major infection vector. In fact I had someone call me to do a house call at their house right after he cleaned their PC up from an infection. What I found was that he left an out of date version of java (or java in general) on the machine. Malwarebytes also wasn't on the machine, even though the invoice said "Scanned with malwarebytes". Im pretty sure he uninstalled it so the customers couldn't do their own scan.

His answer to my question was this..

"Every now and then when I do a scan I see java files, (I think he meant java exploit files) just means they were browsing porn".

*facepalm*

Well I am not as paranoid as you when it comes to java ;) Yes it can be an exploitable point on a users machine while they browse the infection highway that is the public internet.. But their are also other exploits out there that are not java..

Your java threads come across that if your not running java your never going to get infected to me.. To be honest, I think a vast majority of infections are users just being stupid as users tend to be. Be it you have java installed or not.

Got an email from a friend while back -

post-14624-0-02225500-1360082693.jpg

So in this day and age who in their right mind would follow such a link?? Did you just start using email yesterday? Have you not heard any virus related news in the last decade? I have blocked out the info -- because I don't want anyone following such a link out of pure curiosity, etc. Keep in mind the domain in question not even taking into account the rest of the url is not say youtube or other major players site where might be sending link to funny video or article of interest, etc. Then look at the rest of the url -- does that look like a normal link to you?? Really?

Is there any text to go along with said link - hey guys thought you all might find this funny or interesting, etc. Its clearly junk, even if she had sent me that on purpose I would not follow it because there is no explanation of why I should in her style of writing, etc.

So I contacted her right away, and stated either someone is sending junk using your email address, or your account has been compromised and is sending it. She said yeah quite a few of her friends had followed the link - and THEN contacted her on why she sent -- WTF??? Really Come on People!

If you have users that would click on said link, then you have 1000 more users out there that click on the flashy AD on some site that says "Click Me" you have won, or get something FREE or whatever other tricks they use to try and get your click.

I personally would never in a million years follow a AD of any sort.. Just not going to do it -- if in the off chance some Ad peaked my interested on a site.. I would look up that said something on my own and follow though with getting info I needed from my curiosity being peaked.

Do drive-by's happen - sure, is java used to exploit your machine again sure. But also just plain stupidity is to blame that has nothing to do with an exploit to the malware installed - user installed of their own free will is quite often the case. Antivirus/Security suites have a hard time with such software.. Because the user agreed to install it, etc. And yes it might of been in small print, but clearly stated that installing such software allows to access your contact list and send emails to your contacts 3000 times a day, etc. Or to popup **** on your screen that is stuff "we" think you might want, etc. Or we are going to reroute your internet traffic through our proxy/search engine so we can determine what you like and "better" serve you, etc. ;)

Now this ransomware seems very familiar to others out there just taking a different scare tactic approach to relieve idiots from their money -- hey your infected!! Click here to fix it, pay just $39.95 etc. Oh btw we hid all the items off the start bar because they were "infected" ;) We will put them back once they have been cleaned... After you pay the $39.95 -- Sorry that CC did not work, try another, Sorry that one not working either, try another, try another.. I have seen people feed in every CC they own into such nonsense.. Its like when they sit in front of computer they turn off their brain ;)

tl:dr -- ranting about users and infections and lack of common sense.

Malwarebytes also wasn't on the machine, even though the invoice said "Scanned with malwarebytes".

I'm pretty sure he uninstalled it so the customers couldn't do their own scan.

*facepalm*

Glad I can fix my own computers. :s

Agreed, yeah I saw that point - which I completely agree with.. Even people in IT can be clueless.. I just got side tracked with my rant and then when it finally clicked that this is getting so long that nobody is going to read it I forgot to agree with your "facepalm" ;)

This topic is now closed to further replies.
  • Posts

    • You've tried DuckDuckGo and Brave Search, now get serious with SearXNG by Paul Hill Over the last decade, it has become quite trendy to dump Google Search in favor of privacy-preserving alternatives such as DuckDuckGo, Startpage, and Brave Search. These search engines have done a very good job at highlighting dodgy practices by Google, such as adjusting search results based on what it thinks you’ll like (filter bubble) and stalking you around the web to advertise to you. While these search engines are good starting points when compared to non-private services like Google, there are still quite a few issues with them. For example, both DuckDuckGo and Brave Search require running non-free JavaScript in your web browser, which is comparable to running proprietary software on your computer, meaning you can be sure about what it’s actually doing in the background. Another issue is that these search engines are hosted on the respective companies’ servers, and you are using a service that you don’t control. Finally, DuckDuckGo, while offering privacy features, relies heavily on Microsoft’s infrastructure for its results and, in the past, has permitted Microsoft tracking scripts. If you are looking for a more private search solution than DuckDuckGo, Brave Search, and Startpage, then I recommend taking a look at SearXNG. It is a privacy-respecting metasearch engine that can be used via different public instances, which is useful for mobile users, or you can install it on your computer or server and run it locally with maximum control. Unlike Google, Bing, or Brave Search, which crawl the web and have their own search indexes, SearXNG is a metasearch engine, meaning it taps other search engines, stripping your identifying data, such as IP address, user agent, and cookies, in the process. Your search query is sent to the other search engines you enable before aggregating the results. SearXNG has deployment flexibility. If you are a casual user or a mobile user and don’t want to run SearXNG locally, you can use a public instance that is hosted by someone else. The main problem with this is that you are putting trust in the maintainer of the instance regarding stuff like logs that they may keep; good hosts should have a privacy policy explaining their policies. If you are trying to use SearXNG, you can also install the software on your device and then head to 127.0.0.1:8080 in your browser and search from there. While you don’t have to worry about a third-party admin like the public instances, search engines could ultimately block your IP address if they frown on you pulling in their search results locally. If you want to run it locally, it’s a good idea to use proxies or VPNs to hide your actual IP. You don’t have to worry about this with a public instance, as search engines never see your IP address. The main privacy benefit of using SearXNG is that it isolates your identity from the underlying engines that it’s capable of searching, such as Google and Bing. These search engines will only see requests coming from a generic server, so they can’t profile you and create a bubble filter that influences what results you see. This also ensures that your search engine doesn’t turn into an echo chamber that prevents you from reading alternative points of view. As a free software project, you are allowed to inspect SearXNG to make sure there are no negative features bundled inside. This sets it apart from the privacy search engines mentioned earlier because you can’t check their source code. As a meta search engine, you are not restricted to getting results from one source. Due to the fact that it scrapes content from other websites, your SearXNG instance will periodically get blocked from different providers, so it’s good to select a range of sources as a backup. While enabling all of the services will give you great results, this can make searching slower. I am personally happy with slower searches for the best results, but you can always check which providers are slowing down your search from the search results page and disable them to speed things up. If you want decent results quickly, enable the main search providers such as Google, Brave, DuckDuckGo, Qwant, Bing, and Yahoo. This way, you get wide coverage without the latency. On the Engines tab in Preferences, do note that there are different tabs, such as General, Images, and Videos, with their own providers that can be toggled and are not covered by "Enable all" while on the General tab, so be sure to dig into each. Just a note, if you want to enable everything, press "Enable all" in one tab, then hit save at the bottom of the page, then do the next tab, and so on. If you press "Enable all", then do that in each tab, and then save, nothing will stick. When I had just some of the search engines enabled, I searched “define nefarious” and results came back with the definition of “define” - obviously that was a sucky result. However, when I had everything enabled, it found dictionary pages for the word “nefarious” and even had an inline definition on the sidebar, which is quite nice too - that was delivered by WolframAlpha for anyone wondering! Probably the worst thing about this meta search engine is that the engines you select are saved with a cookie, so you must enable them on every new device you use SearXNG on, including if you decide to go into incognito mode with your web browser. Honestly, I would say this is the most annoying aspect, and perhaps if your browser lets you choose a separate private browsing search engine, then it would be best to use DuckDuckGo for this portion of your browsing. Another weakness of SearXNG is the random blocking of it by search providers. When you are on the results page, expand the “Response time” box, and it will show things like “Suspended: too many requests” or “access denied”. This is why it is good to enable several providers so that there is always a fallback to get results from. I won’t pretend SearXNG will be for everyone, however, if you enable all of the providers and put up with the slower response time, the results can be really amazing. Even if you don’t want to use it as your daily driver, keeping a bookmark handy that links to it is a good idea if you ever feel like doing a deep dive into a niche topic where other search engines are just failing to bring up any good result, due to the amount of sources it looks on. If you’re interested in radical user control over the software you use, installing SearXNG locally can also be a good idea, but be prepared to be temporarily blocked from sites if you trigger bot sensors without a VPN. Personally, I’ve opted to use a public instance, rather than install it myself. If you want to use it via a public instance, head over to searx.space to find a provider. Let us know in the comments if you have used SearXNG or its predecessor, Searx. What do you think about the quality of the results?
    • Dear Neowin, If it is not too much trouble, can you start using the new-ish designations for Insider Preview? "Experimental" is different than "former Dev" as it can apply to different models, eg 26H1 or 26H2 etc, right? No need to seed confusion IMHO. And, please "finally" update your graphics. OK?
    • Did you see their FAQ, its quite good. Have a look in the Advanced section. https://delta.chat/en/help
    • Just install Linux Mint that is a real blessing and many times cheaper because you can continue using your old Windows computer/laptop with the latest Linux updates.
    • Interesting share -- however it does not make sense: Email messages get stored somewhere, so how is Delta Chat "based on email" and decentralized without actually storing anything? By Web3 standard practices, the various Relays would require dedicated storage to make messages available to the recipients (like a large series of message queue channels, akin to racks of traditional post office boxes)... and Contacts must be two-way confirmed in order for encryption keys to be exchanged (ostensibly every key-pair is uniquely bound between sender and recipient) and the Relays would preserve the public keys in order to facilitate message carriage... or every device stores all sorts of keys and contact info. All of this to say, decentralized messaging is like running Bluesky nodes except instead of discovering/browsing public feeds by various posters (at the given node) these Delta Chats would be relaying encrypted messages (via Relays) that only trusted recipients would have the appropriate decryption key (their own private key) to read it. But this doesn't solve the "it's like email" sales pitch. The only way it's like email is that there's encrypted binary stuff being transported from your app into the federated ether of Delta Chat Relays for others to decrypt (hopefully only the intended recipient)... but outside of this federated relays framework, it is absolutely nothing like email.
  • Recent Achievements

    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      502
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      158
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!