Ransom Virus

1

1stopgeekshop

New Member
In the past week, I've seen 2 of these "ransom" virus' come through my shop. I was curious if any other tech's have seen them.

Basically when the machine boots up, you're locked out of everything, no admin, no keyboard, no mouse. BIOS works but that does not matter.

There is a window that explains the computer is being held for ransom and if the $20.00 ransom is not paid, files will be deleted off the hard drive.

The hostage must pay $20.00 via western union in order for the machine to be released.

the fix was simple... boot into hirens and run combofix, then removed the drive and plugged drive into test machine and ran the usual anti-virus software.

My question is has anyone else seen this yet... I've seen two in a week.

Thanks geeks! Jason
 
Not personally, but I have read articles. It originally came about in 06, then in 08 and there have been some more recent articles Apr 2010. Some demanding payment for 'violation of copyright laws' based on your browsing history, etc. Most articles reference that these are japanese and/or russian made. (Distributed via P2P)
 
i have not seen or heard of this, very strange, prob came from an email you opened or website you visited, porn sites maybe? strange never the less
 
RE: Thanks.

yeah i found it strange that i had 2 machines in a week come in with it...

Concordedly: i think this one is russian given the wording in the text...

Softe: nope, not me...lol... these are customers machines... (i own a repair shop)

Fira: thanks but i got it with hirens, combofix, mbam and avira...

Thanks for replying everyone... ill keep the forum posted... looks like there may be another wave coming around...
 
If it is like the ones I read, they use encryption and with out the password your data is toast. I also read that a lot of the widely circulated ones all have known passwords so the fixes that fix them should release your data from the encryption, unless it is a new breed which has a different passkey.
 
I haven't seen this particular one, but "ransomware" is pretty common. Usually it's not so direct, and displays itself as a fake antivirus program that is detecting lots of viruses on your computer, but you need to buy the full version to remove them.
 
PohTayToez said:
I haven't seen this particular one, but "ransomware" is pretty common. Usually it's not so direct, and displays itself as a fake antivirus program that is detecting lots of viruses on your computer, but you need to buy the full version to remove them.
Click to expand...

Those are the kind my mom gets... All the time... :rolleyes:

This is completely different. It prevents boot of OS and goes directly into this pay us or all your data will be lost scenario.
 
You must log in or register to reply here.
Back
Top