Blocked PC scam

[Tringa]

Sorry this isn't a thread on general photography discussion, but I couldn't find a better home for it.

There is a good chance that quite a few have already heard of this, but if not --

It first appeared around January this year but has recently resurfaced in the UK and Germany and possibly/probably elsewhere too.

It takes the form of an on screen message that says (in the UK) Metropolitan Police and Strathclyde Police investigations have detected activity from your PC involving illegal sites, possibly pornography, child pornography or terrorism involving Alkaieda and your PC has been locked. To unlock the PC you need to pay £x and it tells you how to do it. Sometimes the message includes what look like police logos.

I'm sure none of us would be taken in by it, but you may know someone who uses a PC but is less Internet and PC savvy and may be worried by it, especially as it appears to have links to the police. So if you hear of anyone who has this little nasty do tell them that it is a scam and under no circumstances should they pay anything.

My PC got it about a week or so ago - I'm guessing from a link on a webpage somewhere that may have included a misdirection - and it does stop all access. The machine will apparently boot up OK, but then goes into the message page and you cannot do anything - the Taskbar had gone AWOL, keyboard does not work, there is no mouse cursor, you can't get to the Control Panel. The only thing you can do is use the big button to turn it off.

Fortunately it is easy to remove. Malwarebytes, which is a free security program, finds and destroys it

http://www.malwarebytes.org/

If you don't have it already I'd recommend it. Free, small and runs quickly.

Bootup in Safe mode and run Malwarebytes and the problem is solved.

Must admit I had a bit of a chuckle at the message. The idea that the police would find activity of the types described, tell you they had found it and then give you your PC back so you can continue, if you pay up.

And "Alkaieda" LOL - I think I used to take that for hangovers!

Have a good New Year all and lets be careful out there.

Dave

[Donald]

This is indeed a genuine one. The community police in our area have been e-mailing their contacts in local communities and asking us to spread the word that this one is out there.

[rpcrowe]

It will probably pop up on this side of the pond soon!

[FrankMi]

Be very careful how you address this kind of threat. The 'fix' is sometimes posted by perpetrator and when you install it, you unknowingly give the perpetrator complete remote access to your PC as they remove the malware that they infected you with. They are after your financial data, account passwords, personal information and much more. Facebook, Twitter, and similar social networking services are a goldmine of your personal information that they can make use of for selecting you as a target.

Some malware can be very nasty, and not easily recoverable, particularly those that disable all the basic forms of recovery before they make themselves known. Sometimes the safest recovery for this kind of malware is a return to a previous system backup, cleaning the OS and all other hard drives in a separate, secure system, or a reformat/reinstall all hard drives after scanning all backup files for the infection.

[Geoff F]

Something new to be wary of then. Thanks Dave, I will pass this on.

Recently I did get a slight variation on an old trick where a pop up pretending to be part of my computer security system tried to alert me to unauthorised changes to my registry and asked me to click on the message to 'clear the problem'.

I just switched off and appear to have avoided that particular incident.

ps. And I use 2 computers; an old one just for the internet while all my photos and other data are on a machine which is never directly connected to the internet.

[Tringa]

Fortunately this particular threat is fairly straightforward.

Even though it says that if you pay you will get a code which will unlock your machine, which could of course be a variation on the scenario Frank has outlined, what actually happens, as at least one unfortunate person in the UK has found out, is you pay the money and you never hear from the perpetrators again. You end up £x down and still have an unusable machine.

The type of nasty Geoff has mentioned is much worse. The variations I heard of have names like Microsoft Security 2011, Microsoft Antivirus 2011, XP Security 2012. Their screens look very good - extremely Microsoft like.

These allegedly find all sorts of malware on your machine and ask for payment to remove them. There is no way of ignoring the bogus message about the malware and the nasty disables the running of most anti-malware programs you have.

A solution is to boot from a CD - a copy of Linux that boots from a CD is only a few pounds - and once you can get into your machine you have much more chance of doing something about it; there are lots of guides on the 'Net. Incidentally, I think having a bootable CD is the nearest thing to a PC version of a get out of jail free card.

Along with Malwarebytes, I find Asquared and SpyBot Search and Destroy very useful against various forms of malware. The other piece of software which is not an anti-malware program but is excellent is, HijackThis. When run it creates a detailed list of registry and file settings. You need to know how to read the log as it does not distinguish between good and bad settings, but at least you can see everything and decide what to delete.

Dave

[Colin Southern]

A quick and dirty fix when this kind of thing (if the PC hasn't been rebooted) is to simply crash the PC (just pull the power cord out). Because it doesn't shut down correctly it won't save the current registry - and next time it's booted it'll use the "last known good" copy. An additional step can be to simply restore it from a previous on-disk backup (you won't lose any data).

[proseak]

It's worth getting a boot-disc for just this sort of scenario - EBCD, UBCD, or my personal favourite, Hiren's Boot CD. I like this one because it's so simple to set up. has drivers for most(?) network adaptors, and includes Avira. If you can't boot into safe mode, this can be a life-saver.

At this point you have to decide between re-installing Windows from scratch(much the safest option) or scanning with a variety of tools and hoping that you get everything.

[arith]

I hope Kasperski can fix it. It isn't generally good to have more than one antivirus, but I think the bootable disk that comes with Kasperski is probably useless.

I had another rescue disk that was also completely useless, and in the end found restore to be the most reliable method of recovery from safe mode, but where this didn't work I have a now failrly old backup drive that will restore C: and cuts down the work involved to get back to up and running.

However, I once had an infection detected by Kasperski that was quarantined but was still able to disable Kasperski,so nothing is infallible, and this was corrected with the direct involvement of Kasperski lab; I made a mistake apparently by not immediately responding to the quarantine request, something I thought was automatic anyway.

Don't feel like making a new backup but after reading this might do.

[Letrow]

Must admit I had a bit of a chuckle at the message. The idea that the police would find activity of the types described, tell you they had found it and then give you your PC back so you can continue, if you pay up.
Dave

Well, the German and Dutch police have a program that they can download to computers and which can then monitor some of your behaviour. Only used on criminals of course, not on us normal users.

If you would like to counter that, visit https://www.torproject.org/ . This software can shield your computer from nosy persons or organizations. They have a shielded browser as well, based on Firefox, that does the same thing for your internet behaviour.

Only if you are paranoid and believe that governments or others could actually do this to you.

[arith]

Well, the German and Dutch police have a program that they can download to computers and which can then monitor some of your behaviour. Only used on criminals of course, not on us normal users.

If you would like to counter that, visit https://www.torproject.org/ . This software can shield your computer from nosy persons or organizations. They have a shielded browser as well, based on Firefox, that does the same thing for your internet behaviour.

Only if you are paranoid and believe that governments or others could actually do this to you.

Interesting; I heard somewhere remote control of webcams is possible and because mine had a life of its own is disconnected. In fact you only have to be different to come under the radar; and I was most interested in why the cops were accusing BB holders of being terrorists and came to the conclusion it must be because they can evesdrop or listen in to any other type phone, and so I got myself a BB but found it to not be as good as implied by the cops. It doesn't work in communication between BB and a landline such as a bank could use; it only works BB to BB if they know each other.

So getting a BB for financial security wasn't a good idea since it isn't more secure than any other type of phone. BB=BlackBerry

[Sunray]

Well, the German and Dutch police have a program that they can download to computers and which can then monitor some of your behaviour. Only used on criminals of course, not on us normal users.

This monitoring software that german police uses is called federal government trojan, in german "Bundestrojaner". When the corresponding laws were introduced officials tried to allow the use without the necessity of judicial decision. Stealthy home searching was not allowed even in the german empire before 1918. That generated a major wave of protest and german supreme court stopped that law nearly instantly. The minister of the interior at that time was compared to the former eastern german secret police "STASI". So officials made a new law that allows monitoring computers in case of capital crime if a judicial decision is present. A few months ago the CCC (Chaos Computer Club), a legal organisation of "white" hackers and computer nerds found out that "Bundestrojaner" software can also be used to MANIPULATE the computer. So again political trouble. Some years ago a new political party "The Pirates" formed in germany that stands especially for civil rights and digital liberty. It is a little bit like in the late seventies, when the "Green" party formed due to ecological problems. If there were elections today they would even make it into the parliament. The last thing I heard about that topic was that some politicians try to argue that data at cloud providers does not count as "private" data because it is not stored at home.
The morale of the story:
Never ever trust politicians in charge!

The other thing is that some bad guys have developed scam software that shows messages on your screen that your computer is monitored by police because you should have done illegal things. Its look is very professional. Even a federal logo is on that message screen. The user should pay money somewhere to overcome an official sharge. Never ever do this. It is only scam. It has not to do anything with the police. I work in an IT company and saw it more than once.

Robert

[krispix]

This monitoring software that german police uses is called federal government trojan, in german "Bundestrojaner". When the corresponding laws were introduced officials tried to allow the use without the necessity of judicial decision. Stealthy home searching was not allowed even in the german empire before 1918. That generated a major wave of protest and german supreme court stopped that law nearly instantly. The minister of the interior at that time was compared to the former eastern german secret police "STASI". So officials made a new law that allows monitoring computers in case of capital crime if a judicial decision is present. A few months ago the CCC (Chaos Computer Club), a legal organisation of "white" hackers and computer nerds found out that "Bundestrojaner" software can also be used to MANIPULATE the computer. So again political trouble. Some years ago a new political party "The Pirates" formed in germany that stands especially for civil rights and digital liberty. It is a little bit like in the late seventies, when the "Green" party formed due to ecological problems. If there were elections today they would even make it into the parliament. The last thing I heard about that topic was that some politicians try to argue that data at cloud providers does not count as "private" data because it is not stored at home.
The morale of the story:
Never ever trust politicians in charge!

The other thing is that some bad guys have developed scam software that shows messages on your screen that your computer is monitored by police because you should have done illegal things. Its look is very professional. Even a federal logo is on that message screen. The user should pay money somewhere to overcome an official sharge. Never ever do this. It is only scam. It has not to do anything with the police. I work in an IT company and saw it more than once.

Robert

Haven't these guys ever heard of the European Convention on Human Rights?

They sold us a law on Human Rights on the basis that it was what every other member of the EU had signed up to. If that's so the Germans & Dutch are in pretty serious breach.

[shreds]

Dump the PC get a Mac. Not immune from this stuff but a lot less problem than the MS versions with its exe files and trojans

[Tygart]

Dump the PC get a Mac. Not immune from this stuff but a lot less problem than the MS versions with its exe files and trojans

Dump both and use Linux. not installing a virus unless you manualy install it, Linux does not use the same files as Micro$oft, no worries or .exe files there, Linux is faster, usese less RAM and Harddrive space, more secure, and the mojority of virus are pointed toward Micro$oft...

For those who need Windows for thier photoshop can keep it, but I would have my main computer installed with Linux. Much safer and more secure.

[arith]

The morale of the story:
Never ever trust politicians in charge!

Cheers Robert but I think that should read 'never trust a politician that is still breathing', and even when they appear to not be, check and double check.

I'm getting quite long in the tooth now, and I'm beginning to think either politicians think they are a superior being and it is beneath them to communicate with commoners, or they really do believe the crap they say.

[shreds]

Dump both and use Linux. not installing a virus unless you manualy install it, Linux does not use the same files as Micro$oft, no worries or .exe files there, Linux is faster, usese less RAM and Harddrive space, more secure, and the mojority of virus are pointed toward Micro$oft...

For those who need Windows for thier photoshop can keep it, but I would have my main computer installed with Linux. Much safer and more secure.

I wont disagree, but Linux is still too geeky for a lot of folk and software as you point out is limited. At least with a Mac, CS5 and many many other programmes are readily available. Add to that there are so many flavours of Linux and the average punter steers elsewhere, despite the security benefits.

[Tygart]

I wont disagree, but Linux is still too geeky for a lot of folk and software as you point out is limited. At least with a Mac, CS5 and many many other programmes are readily available. Add to that there are so many flavours of Linux and the average punter steers elsewhere, despite the security benefits.

You are incorrect, Not too geeky at all, its just a matter of getting to know where things are and how to change settings, and Linux has 1000s of free software accessable by the (Software Center), it can be found in your menu, the software is just as good as MS most are even better for a number of reasons... As for flavors is not too bad, the computer user who wants an easy to use computer can use Ubuntu, I would suggest using "Kubuntu" This one is the most (Windows) feel to it.

There is nothing about Linux that is difficult or lacking.

Explanation: There are a number of Ubuntu Linux OS you can download. They are all built by Ubuntu. The differance is how they will look and feel.

Ubuntu: Basic orginal, currently has a tablit like navagation.
Kubuntu: More graphical (Apparance of the desktop, graphical, icons) has a Winodws like navagation.
Xubuntu: Less Graphical faster, still has a windows like feel.
Lubuntu: Fast light weight

Eveything you see can be downloaded and can be burned Live CD and you can try them out with out installing.

[Hero]

It took my girlfriend a while (weeks) before she realised my computer was an Ubuntu-box and thus she was working on linux. It realy isn't that geeky anymore (unless you dive under the hood, but so is windows)

[Letrow]

It realy isn't that geeky anymore (unless you dive under the hood, but so is windows)

It does depend on your definition of geeky. If Ubuntu comes pre-installed on computers (and I have seen some Dell computers that had this) it is fine. If you have to do it yourself on an existing Windows computer (and have to create extra space next to your Windows installation) it is slightly different. A lot of people I know would balk at this.
But I agree that, once installed, Ubuntu works fine. Good programs and much faster.