Home Malware Programs Trojans Trojan.Reveton.B


Posted: March 21, 2013

Threat Metric

Threat Level: 8/10
Infected PCs: 459
First Seen: March 21, 2013
Last Seen: November 18, 2020
OS(es) Affected: Windows

In a case of a scam hedging its bets, PWS:Win32/Reveton.B is a spyware-based Trojan that is installed as a secondary PC threat during a traditional Reveton-based Police Trojan's attack. Members of the Reveton family usually are associated with ransom attempts that are enabled through Windows-locking attacks and fake legal warnings, but PWS:Win32/Reveton.B has entirely different functions, which SpywareRemove.com malware analysts have noted are geared towards stealing sensitive information. PWS:Win32/Reveton.B targets many kinds of programs, including FTP clients, Poker games, e-mail clients and download managers, along with any browser-saved passwords. PWS:Win32/Reveton.B also is flexible enough to be reconfigured to target other kinds of data, and any possible PWS:Win32/Reveton.B infection always should be considered a high-level threat to be exterminated with the right anti-malware tools.

PWS:Win32/Reveton.B: the Spy that Hides Beneath Ransomware

Past examinations of members of the Reveton family have focused on PC threats like the United States Department of Justice Pop-up Alert, the Bundespolizei Ukash Virus, the Strathclyde Police Ukash Virus, the FBI Green Dot Moneypak VirusPolice Ransomware Trojans. In all cases, the dominant symptom of a Reveton attack was the fake police warning – localized for the compromised PC's country – that claimed the computer was locked as a penalty for a range of online crimes (usually related to downloading illegal media). PWS:Win32/Reveton.B is, therefore, something of a standout for not including any Police ransomware-related features at all.

PWS:Win32/Reveton.B actually is a spyware program that is installed along with a more typical Reveton member than itself. While the Police Trojan attacks your PC and displays its fake legal alert, PWS:Win32/Reveton.B attempts to fetch and steal your personal information. Based on SpywareRemove.com malware experts' latest analyses, samples of PWS:Win32/Reveton.B 's current targets include:

  • Major brands of poker gaming programs.
  • FTP management programs such as Smart FTP or Core FTP.
  • Social networking utilities (chat and messaging programs).
  • E-mail accounts.
  • File download managers such as Getright.
  • Remote Control utilities.
  • Most importantly, PWS:Win32/Reveton.B also targets and steals confidential information that your browser saves, such as any website passwords or other login information.

Saving Your Wallet from Reveton and Your Info from PWS:Win32/Reveton.B

Any Police Trojan infection always should be understood to be a fake warning that shouldn't be rewarded with ransom money in return for its system lockdown. Instead of following the advice that's based on the Internet of a PWS:Win32/Reveton.B attack, SpywareRemove.com malware researchers suggest using typical anti-malware procedures (such as booting your computer from an emergency flash drive) to disable all PC threats, including PWS:Win32/Reveton.B.

With a safe scanning environment, you then can use an anti-malware scanner of your choice to remove PWS:Win32/Reveton.B and other components of a Reveton infection. You should be aware that this doesn't protect any data that PWS:Win32/Reveton.B may have stolen previously, and, as a general precaution, changing all account passwords afterward is suggested. Additionally, the DLL-loading technique that launches PWS:Win32/Reveton.B also can be applied to other types of malware, and you should be prepared for similar attacks targeting different types of information than the examples listed here.


Suspicious file [Panda]W32/Sality.Patched [AntiVir]Trojan.Generic.6554505 [BitDefender]W32/Patched.Y.gen!Eldorado [F-Prot]Win32/Heur [AVG]TR/Vundo [AntiVir]Packed.Win32.Krap [Ikarus]Generic PWS.ak [McAfee]Worm.AutoRun.gen [CAT-QuickHeal]Trojan.Magania-9826 [ClamAV]WORM_ONLINEG.JLD [TrendMicro]W32/FakeAlert.AH.gen!Eldorado [F-Prot]Trojan-PSW:W32/OnlineGames.gen!E [F-Secure]not-a-virus:AdWare.MSIL [Ikarus]TR/StartPage.alc.2 [AntiVir]
More aliases (90)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe File name: Uninstall.exe
Size: 485.38 KB (485384 bytes)
MD5: 366bd60c3eea215867724fb463b72f3d
Detection count: 133
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe
Group: Malware file
Last Updated: August 31, 2022
D:\Downloads\Tutti i file pc acer\TER\uffa\Non confermato 442073.crdownload File name: Non confermato 442073.crdownload
Size: 3.18 MB (3181243 bytes)
MD5: 2f46a6a395db52c1209e79db86c139a5
Detection count: 131
Mime Type: unknown/crdownload
Path: D:\Downloads\Tutti i file pc acer\TER\uffa\Non confermato 442073.crdownload
Group: Malware file
Last Updated: October 10, 2023
%WINDIR%\system32\bgotrtu0.dll File name: bgotrtu0.dll
Size: 94.2 KB (94208 bytes)
MD5: ffbc4f9f03eaa07872ebada9d13544c1
Detection count: 45
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32
Group: Malware file
Last Updated: March 29, 2013
%APPDATA%\invidia\invidia.exe File name: invidia.exe
Size: 552.96 KB (552960 bytes)
MD5: fb4f720262f1c575aba45e4acab46258
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\invidia
Group: Malware file
Last Updated: March 29, 2013
%ALLUSERSPROFILE%\D67DF1AC6D6BAA7B8B3C2E8F244BB.exe File name: D67DF1AC6D6BAA7B8B3C2E8F244BB.exe
Size: 51.2 KB (51200 bytes)
MD5: b4c1de9bb3d823e5bbd84dfb3110b190
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 21, 2013
%PROGRAMFILES%\IM Magician\Vicamon.exe File name: Vicamon.exe
Size: 143.36 KB (143360 bytes)
MD5: 35513ee182905dcdca8605a0829c54ba
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\IM Magician
Group: Malware file
Last Updated: March 29, 2013