I am c# developer and i am researching on security and i am totally new in this field.

Some month ago i received a mail like this :

This is the last warning. 
I hacked your operating system through the Wi-Fi router you were connecting to! 
A few months ago, I accessed your devices that you use to access the internet.
All the data from your devices is copied to my servers. 
I have access to all your messengers, social networks, emails, chat history and contact list.
And I have access to all your personal data I have already copied to my servers.
My virus constantly updates its signature (driver based), therefore it remains invisible to antivirus software.
I guess now you understand, why I stayed unnoticed until this letter...
In gathering information about you, I discovered that you are a big fan of adult websites and more. 
You really like to visit porn sites and watch dirty videos while having an orgasm.
I've already made a screen capture. 
A montage of the pornographic video you were watching at the time and your masturbation.
Your face is clearly visible. I don't think this kind of content would be good for your reputation. 
I can send this video out to everyone who knows you.
I also have no problem with making all of your private data public on the Internet.
I think you know what I mean.
It would be a real disaster for you.
I could ruin your life forever.
I think you really don't want that to happen.
Let's solve it this way: you transfer me 1500 $ (USD) (in Bitcoin equivalent at the exchange rate at the moment of transfer), and I will immediately delete all this dirt from my servers.
After that we will forget about each other.
My bitcoin wallet for payment: bc1qx7jundhh20ap2ac7hds9fawqlrqh46n4daks23
If you do not know how to transfer money and what Bitcoin is. Then type in Google query "Buy Bitcoin".
I give you 2 working days to transfer the money.
The timer started automatically as soon as you opened the email. 
I get a notification when this email is opened.
Do not try to complain anywhere, as a purse will not track, mail from where the letter came, and is not tracked and created automatically, so there is no point in writing to me.
Do not try to contact the police and other security services, otherwise your data will be published.
Changing passwords in social networks, mail, device will not help you, as all the data is already downloaded to a cluster of my servers.
Good luck and don't do anything stupid. Think about your future.

I figured out some body has hacked my wi-fi really and has connected to it.
After connect to it he added a rule to my licensed Eset Internet Securty FireWall to allow connected new device IP (
My machine os is windows.
I have both Eset Internet Security + MalwareBytes (Latest Version & Updated & Licensed)
I grabbed this ip address with eset :

Virus Total of
And figured Out :

  1. svchost.exe
  2. lsass.exe
  3. vmnat.exe
  4. node.exe | Included in this path : "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs" | as Node.js: Server-side JavaScript
  5. MbamService.exe

node.exe crypto sign attempt

All of these files want to connect to that ip.
Here is some info about that ip :

ip :
isp : edgecast.com
abuse mail :abuse@verizondigitalmedia.com
IP2Location -
os : FreeBSD
running services :

  1. bnetgame
  2. rtmp

I scanned my C drive with Eset Internet Security , MalwareBytes , Norton Rescue Disk in Boot.
No detection(s) at all.
I installed wireshark in my machine and figured out there are many suspicious http requests (Get) through my wi-fi.
Some of them are like this :

http.request.full_uri == http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D

http.request.full_uri == http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0tOcjGcdlkhVARHvHzj6Qwhh26wQUpI3lvnx55HAjbS4pNK0jWNz1MX8CEAEeOxqgEsxHmhsRtboTdCY%3D

http.request.full_uri == http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEApK5qT98YzxYM%2F8meUnSyw%3D

http.request.full_uri == http://crl.verisign.com/pca3.crl

http.request.full_uri == http://s.symcb.com/universal-root.crl

http.request.full_uri == http://crl.verisign.com/pca3-g5.crl

http.request.full_uri == http://crl.verisign.com/pca3.crl

User Agent of all these requests is like this :

http.user_agent == "Microsoft-CryptoAPI/6.1"

VirusTotal Scan of two of them :


I also have many unknown TCP packets related to that ip and other ips.
It seems i have infected with a bad ransomware that is using many CDNs.
I blocked CryptoSvc service in Eset after viewing those http requests.
I also blocked that ip in firewall.
But i think this is useless because malicious app is using many ips as well.
I figured out my PC and my LapTop and my vmware windows machine installed on pc all of them have infected.
I don't know that was because my wi-fi network or infected USB flash memory.

PLEASE GIVE ME SOME ADVICE and tell me how can i remove this rat or ransomware or whatever it is from my devices?
Also tell me how is that possible about my USB flash drive infection.
My files have n't encrypted yet.
So i have time to remove this ransomware or whatever it is.

  • 6
    You don't have ransomware, you have a threatening email that claims all sort of things that are not true. Delete the email and move on with your life.
    – gowenfawr
    May 11 at 14:55
  • 2
    That IP and those links are perfectly normal and fine. Nothing you have shown indicates any infection or suspicious activity.
    – schroeder
    May 11 at 15:23
  • If the guy really had hacked you, he'd have some form of proof (placing a file on your desktop, changing your background, accessing your files, etc...)
    – MechMK1
    May 11 at 15:45
  • @schroeder my dear friend, Just tell me why firefox-svchost-lsass-node trying to connect to that ip? Is it normal? I do n't think so. Also tell me why virustotal shows that ip as malicious? I have infected surely. May 11 at 15:54
  • 1
    First of all, your major concern should be getting rid of Windows 7, it has no more security updates. That IP is from Digicert, which is a domain that validates digital certificates. A LOT of requests pass through that IP, both legitimate and malicious, so do not blindly trust Virus Total's community score. As Schroeder said, connections to that IP are normal, but you really should nuke it from orbit (it's possible that you have been compromised by means not related to that email) and update to Windows 10. Just forget about that email, people receive things like that every week nowadays.
    – Mycroft
    May 11 at 19:37


Browse other questions tagged or ask your own question.