Ransoming your Windows activation

Steven — Mon, 17 May 2010 21:46:57 +0000

According to the team over at Sunbelt Software, the company behind VIPRE and and the Sunbelt Personal Firewall, there is a piece of malware out there that looks to hold your computer ransom by tricking you into thinking that you are running a pirated version.

To do this the malware pops up a screen that looks pretty authentic encouraging you to activate your pirated copy of Windows right now. If you decide not to it will lock up your computer so that the only thing you can do is fill out all the information needed – including your credit card info – in order to unlock your computer.

While their claim that your credit card won’t be charged might be true the fact is that it is automatically sent off to a network of bots set up to collect the information.

The post over at Sunbelt has the complete screen shots of the ransomware in action, including the receiving end as it collects the information.

Ransoming your Windows activation is a post from: winextra
Follow us on Twitter: @WinExtra | Don't forget we're on Facebook as well: WinExtra Fans

Don't forget to check out the WinExtra Community Forums - registration is free.

A nasty ransomware trojan making the rounds

Steven — Tue, 10 Nov 2009 00:47:25 +0000

For those not familiar with the term ransomware trojans basically infect your computer and in the process encrypt your files, change extensions and several types of nasty tricks to them. When done the trojan will typically pop up a dialog demanding cash to return your system to normal.

There is a new one according to a report from Symantec called Ramvicrype Trojan that well encrypt your files and then when you are search for a fix you find yourself directed to a website that will sell you some software to fix the problem. The search will yield the expected results because of the unique file extension the malware uses on the encrypted files.

Using the file extension – *.vicrypt it takes short order to find the solution but Symantec has published a specific utility program to help any victims hit by this trojan.

Symantec virus researcher Shunichi Imano said in a blog entry that Ramvicrype victims will see some files on the computer with a vicrypt extension.
Entering the term ‘vicrypt’ into a search engine leads us to a company offering a fix, which of course is a charged service. So, there was a reason for that file extension after all.
The security vendor has developed a Symantec Ramvicrype removal tool for victims to decrypt the files.

The one other solution is to make sure you have a current image file of your system and then restore if hit by crippling malware such as this one.

hat tip to the Security Bytes team.

A nasty ransomware trojan making the rounds is a post from: winextra
Follow us on Twitter: @WinExtra | Don't forget we're on Facebook as well: WinExtra Fans

Don't forget to check out the WinExtra Community Forums - registration is free.

Winextra » ransomware

Ransoming your Windows activation

A nasty ransomware trojan making the rounds