Trojan.Reveton.B

Posted: March 21, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	459

First Seen:	March 21, 2013
Last Seen:	November 18, 2020
OS(es) Affected:	Windows

In a case of a scam hedging its bets, PWS:Win32/Reveton.B is a spyware-based Trojan that is installed as a secondary PC threat during a traditional Reveton-based Police Trojan's attack. Members of the Reveton family usually are associated with ransom attempts that are enabled through Windows-locking attacks and fake legal warnings, but PWS:Win32/Reveton.B has entirely different functions, which SpywareRemove.com malware analysts have noted are geared towards stealing sensitive information. PWS:Win32/Reveton.B targets many kinds of programs, including FTP clients, Poker games, e-mail clients and download managers, along with any browser-saved passwords. PWS:Win32/Reveton.B also is flexible enough to be reconfigured to target other kinds of data, and any possible PWS:Win32/Reveton.B infection always should be considered a high-level threat to be exterminated with the right anti-malware tools.

PWS:Win32/Reveton.B: the Spy that Hides Beneath Ransomware

Past examinations of members of the Reveton family have focused on PC threats like the United States Department of Justice Pop-up Alert, the Bundespolizei Ukash Virus, the Strathclyde Police Ukash Virus, the FBI Green Dot Moneypak VirusPolice Ransomware Trojans. In all cases, the dominant symptom of a Reveton attack was the fake police warning – localized for the compromised PC's country – that claimed the computer was locked as a penalty for a range of online crimes (usually related to downloading illegal media). PWS:Win32/Reveton.B is, therefore, something of a standout for not including any Police ransomware-related features at all.

PWS:Win32/Reveton.B actually is a spyware program that is installed along with a more typical Reveton member than itself. While the Police Trojan attacks your PC and displays its fake legal alert, PWS:Win32/Reveton.B attempts to fetch and steal your personal information. Based on SpywareRemove.com malware experts' latest analyses, samples of PWS:Win32/Reveton.B 's current targets include:

Major brands of poker gaming programs.
FTP management programs such as Smart FTP or Core FTP.
Social networking utilities (chat and messaging programs).
E-mail accounts.
File download managers such as Getright.
Remote Control utilities.
Most importantly, PWS:Win32/Reveton.B also targets and steals confidential information that your browser saves, such as any website passwords or other login information.

Saving Your Wallet from Reveton and Your Info from PWS:Win32/Reveton.B

Any Police Trojan infection always should be understood to be a fake warning that shouldn't be rewarded with ransom money in return for its system lockdown. Instead of following the advice that's based on the Internet of a PWS:Win32/Reveton.B attack, SpywareRemove.com malware researchers suggest using typical anti-malware procedures (such as booting your computer from an emergency flash drive) to disable all PC threats, including PWS:Win32/Reveton.B.

With a safe scanning environment, you then can use an anti-malware scanner of your choice to remove PWS:Win32/Reveton.B and other components of a Reveton infection. You should be aware that this doesn't protect any data that PWS:Win32/Reveton.B may have stolen previously, and, as a general precaution, changing all account passwords afterward is suggested. Additionally, the DLL-loading technique that launches PWS:Win32/Reveton.B also can be applied to other types of malware, and you should be prepared for similar attacks targeting different types of information than the examples listed here.

Aliases

Suspicious file [Panda]W32/Sality.Patched [AntiVir]Trojan.Generic.6554505 [BitDefender]W32/Patched.Y.gen!Eldorado [F-Prot]Win32/Heur [AVG]TR/Vundo [AntiVir]Packed.Win32.Krap [Ikarus]Generic PWS.ak [McAfee]Worm.AutoRun.gen [CAT-QuickHeal]Trojan.Magania-9826 [ClamAV]WORM_ONLINEG.JLD [TrendMicro]W32/FakeAlert.AH.gen!Eldorado [F-Prot]Trojan-PSW:W32/OnlineGames.gen!E [F-Secure]not-a-virus:AdWare.MSIL [Ikarus]TR/StartPage.alc.2 [AntiVir]
More aliases (90)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe

File name: Uninstall.exe
Size: 485.38 KB (485384 bytes)
MD5: 366bd60c3eea215867724fb463b72f3d
Detection count: 133
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe
Group: Malware file
Last Updated: August 31, 2022

D:\Downloads\Tutti i file pc acer\TER\uffa\Non confermato 442073.crdownload

File name: Non confermato 442073.crdownload
Size: 3.18 MB (3181243 bytes)
MD5: 2f46a6a395db52c1209e79db86c139a5
Detection count: 131
Mime Type: unknown/crdownload
Path: D:\Downloads\Tutti i file pc acer\TER\uffa\Non confermato 442073.crdownload
Group: Malware file
Last Updated: October 10, 2023

%WINDIR%\system32\bgotrtu0.dll

File name: bgotrtu0.dll
Size: 94.2 KB (94208 bytes)
MD5: ffbc4f9f03eaa07872ebada9d13544c1
Detection count: 45
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32
Group: Malware file
Last Updated: March 29, 2013

%APPDATA%\invidia\invidia.exe

File name: invidia.exe
Size: 552.96 KB (552960 bytes)
MD5: fb4f720262f1c575aba45e4acab46258
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\invidia
Group: Malware file
Last Updated: March 29, 2013

%ALLUSERSPROFILE%\D67DF1AC6D6BAA7B8B3C2E8F244BB.exe

File name: D67DF1AC6D6BAA7B8B3C2E8F244BB.exe
Size: 51.2 KB (51200 bytes)
MD5: b4c1de9bb3d823e5bbd84dfb3110b190
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: March 21, 2013

%PROGRAMFILES%\IM Magician\Vicamon.exe

File name: Vicamon.exe
Size: 143.36 KB (143360 bytes)
MD5: 35513ee182905dcdca8605a0829c54ba
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\IM Magician
Group: Malware file
Last Updated: March 29, 2013