Content:
A big trend of today’s cybercrime is distributing ransomware locking victims’ computers allegedly on behalf of local law enforcement agencies. One of such infections pretends to come from the Royal Canadian Mounted Police, a reputable Canadian national police service. While the name of this institution inspires undoubted trust, blocking PCs is definitely not on the list of their practices.
The malware to blame is called Reveton, which is a Trojan designed specifically to disable user access to the affected operating system. This virus is sophisticated enough to determine which country the infected machine is in, so that it gets the corresponding external manifestation. Numerous instances of contamination with this threat testify to the fact that some security software turns out incapable of intercepting the malicious thing. Moreover, infiltration proper may take place covertly through exploiting Java vulnerabilities and other out-of-date software’s flaws.
Having made it into the targeted system, Reveton displays a lock screen during Windows startup, stating that “the work of the computer has been suspended on the grounds of unauthorized cyberactivity”. The fabricated message also provides the specific laws that the user has purportedly violated, relating to Copyright violation, adult content distribution, promoting terrorism, cheating with payment cards, etc. According to the alert, the unlock routine implies submitting a code from a 100 CAD value Paysafecard or Ukash prepaid card which can be bought in a variety of places throughout the country.
Along with prevalently hitting Windows, this particular malicious code was found to be able to affect Mac OS as well. However, the latter instance is much less severe since it results in blocking Safari browser only, not the entire system access.
Our key advice here is to abstain from doing what the fraudsters ask – first off, because you didn’t actually violate anything, and secondly, because the lock screen is all fake. The rest of this article sheds light on details of this ransomware’s activity, and provides a comprehensive step-by-step cleanup method to help you combat and defeat the Royal Canadian Mounted Police (RCMP) virus for good.
There have been several updates to the lock screen generated by this malware. The pages do differ significantly in their design, yet the key idea remains unaltered: displaying a spooky alert that the PC has been locked, listing the laws that were supposedly violated, and demanding the victim to pay a 100 CAD fine via Ukash or Paysafecard. On Mac OS, the fake block page appears in all tabs opened in Safari browser. Below are images of the screens this ransomware was found to display.
Due to peculiarities of this malware, standard cleanup through launching security software installed on the affected computer is not applicable. Likewise, manual removal is considerably aggravated because of inability to access system directories where the virus embeds its components.
Having thoroughly analyzed this piece of malicious code, we came up with a number of removal methods that proved to work in terms of complete extermination of the RCMP Ukash/Paysafecard virus.
For performing this removal procedure, you will need a USB drive to further launch the cleanup software from. Please note that all the data on this USB drive will be lost, so make sure you back it up before proceeding.
This cleanup method allows restoring your operating system to the time period when it was not contaminated with the RCMP ransomware. This procedure will not lead to loss of any files. To perform system restore, please stick to the following steps:
Download, install and run reliable security software to get effective protection from cyber threats further on.
All you need to do in order to eliminate the RCMP ransomware from your Mac computer is resetting the browser which has been affected. Click on the Safari button in the upper left-hand corner of the browser and proceed to the Reset Safari… option. Make sure all items are checked in the corresponding window, and hit Reset.
Now you’re done. With all the benefits of this method, i.e. its effectiveness and simplicity, there is a drawback which consists in the fact that all of your saved passwords, browsing history, list of downloads, etc. will vanish. However, this will assure that you won’t suffer from the consequences of the Royal Canadian Mounted Police virus any longer.
Exposure management is changing the way we assess risk, but not everyone is out in… Read More
Introduction: Navigating the SOCaaS Revolution In today's hyperconnected digital landscape, where cyber threats evolve faster… Read More
The Middle East and Asia are fast-growing hubs for both digital innovation and cyber threats,… Read More
In Europe, digital forensics and incident response firms operate within a complex landscape shaped by… Read More
The United States is home to many of the world’s leading digital forensics and incident… Read More
Third-party vendors have transformed operations for many entities. Tasks like payroll, shipping logistics, and IT… Read More
View Comments
Thank you so much, I thought my computer was dead. Everytime I booted up my computer it would shut down. For anyone unsure about feeling it maybe to difficult, it was pretty easy to follow the directions that privacypc.com laid out. If you want to save your computer, use this site!
Thanks,
BAM