Copyright violation alert ransomware in the wild

[Night Hawk]

April 12th, 2010

Copyright violation alert ransomware in the wild

Posted by Dancho Danchev @ 7:02 am



A currently ongoing ransomware campaign is using a novel approach to extort money from end users whose PCs have been locked down.

By pretending to be the fake ICPP Foundation (icpp-online.com), the ransomware locks down the user’s desktop issuing a “Copyright violation: copyrighted content detected” message, which lists torrent files found on the infected PC, and forces the user to pay $400 for the copyright holder’s fine, emphasizing on the fact that “the maximum penalties can be five years in prison and up to $250,000 in fines.

More details on the campaign:


Upon execution the ransomware will change the Desktop’s wallpaper to the “Warning! Piracy detected!” background.

• Consider going through the The Ultimate Guide to Scareware Protection to find out more about how malware/scareware and ransomware propagates, and how to avoid falling victim into the scam

More at: Copyright violation alert ransomware in the wild | Zero Day | ZDNet.com

 

[NoN]

You"ll have to be dumb to pay that amount...right away.

I guess manies are knowing it is barely impossible such thing happens to force you to pay before any policemen investigations break your front door!:sarc:

"Money, always that damn money!"

 

[hoganth]

Scammers

First clue would be that the creators of this warning message don't know how to spell. Incorrect spelling is a pretty good clue to a scam.
Receive and Received is misspelled.
my .02 worth
:huh:

 

[derekimo]

First clue would be that the creators of this warning message don't know how to spell. Incorrect spelling is a pretty good clue to a scam.
Receive and Received is misspelled.
my .02 worth
:huh:

Good eye hoganth, Good point too.
I certainly wouldn't give up any money that easy either.

 

[polarbear]

makes note to ban my kid off computer...

 

[Night Hawk]

A friend just asked for help when some bogus av program locked him out of the desktop and actually created a new admin account on the older XP build. I;ve tried getting him to watch the things he clicks on to no avail. A separate system rescue program had to downloaded to a flash drive and copied onto the infected system with that booted in safe mode just to copy the file over to the main drive.

The bogus av claimed all things were infected and he had to buy the full version of ... what? No trial was on and no program in the add/remove either. Fortunately he was able to get the rescue program running when rebooting with a normal startup and saw the I-Worm type hoax removed! The new admin account vanished as well once the bug was off.

All this shows people have to stay onguard for all types of gimics to infect pcs or scam people out of their incomes! The opportunists lurk in the shadows or under false guises to beware of!

 

[CarlTR6]

I hope he learned from this.

 

[Night Hawk]

Maybe? Most likely not however! At first a drive wipe was being pondered due to the volume of bugs thought to be on the 4yr. old installation. Surprizingly the rescue program cleaned not only the bogus av program but numerous other adbots and whatever as it ran.

A few years back if I recall there was some bogus virus alert that claimed your hard drive would be ruined if it got on making the drive useless. Obviously another form of scam being seen then to get people to buy some software! This is why you always double check any offers and look for a main home site before even pressing any upgrade to buy option to avoid being taken in!

 

[NoN]

A friend just asked for help when some bogus av program locked him out of the desktop and actually created a new admin account on the older XP build. I;ve tried getting him to watch the things he clicks on to no avail. A separate system rescue program had to downloaded to a flash drive and copied onto the infected system with that booted in safe mode just to copy the file over to the main drive.

The bogus av claimed all things were infected and he had to buy the full version of ... what? No trial was on and no program in the add/remove either. Fortunately he was able to get the rescue program running when rebooting with a normal startup and saw the I-Worm type hoax removed! The new admin account vanished as well once the bug was off.

All this shows people have to stay onguard for all types of gimics to infect pcs or scam people out of their incomes! The opportunists lurk in the shadows or under false guises to beware of!

He he he...that's is not a new one from hoax...it happens once to me back in the early XP and i had hard time as the seller repair shop had too...he had to change me the infected machine after six month to a new one. It has cost them a fortune during all the warranty time and luckily they couldn't blame me as i had paid the Norton Software pre-installed for the year warranty.

 

[Night Hawk]

When you looked at the name of the phony program it was newer then the PCVirus2009 hoax now being called System Protect trying trick people by borrowing the name of an actuall freeware program by the same name. Only the real program is seen in the Control Panel and offers the uninstall option as well.

Wait a few more months and some other name will appear! This is why playing it smart by first looking anything new first to get the facts before installing it can save you a world of hurt later!

 

[NoN]

How many percent of people are looking at their programs installed on their machine before it's too late? I was one of them years ago. Internet is still very new after all and attractive to handy softwares you could think safe...

 

[Night Hawk]

If you call nearly 20yrs. new that is. You see far more advertising by ISPs competing with each other with each claiming they offer the fastest speeds. (really?)

The fake softwares trap many by appearing to be some nice new program that ends up either spreading a virus or embedding trojans and downloaders even ad generators if they are not geared to get at personal data. When any program installs automatically before you can reach a home page or at least download page with some information you likely have a problem.

For the novice user one of the best protections is having a working firewall inplace. If something doesn't seem right with any new program you can still opt to block and exit any installation attempt in most cases.

SOME FOOD FOR THOUGHT:

Upon going through the 159 emails from one source that come in on a regular this one struck a note here.

Live Webcast: Fake Anti-Virus: What You Need to Know

Join us for this LIVE Event on:
Thursday, May 20, 2010
2:00 PM ET / 11:00 AM PT / 6:00 PM GMT

Overview:

Poisoned SEO pages and email and social networking spam that direct users to fake anti-virus sites are on the rise, putting your organization at risk. Users are tricked into thinking their computer has been infected and they must buy software to remove the viruses. Once installed, the fake anti-virus may also install other malware such as spam bots or keyloggers. Don't let this happen to you or your employees.

The rest is seen at: http://whitepapers.zdnet.com/abstract.aspx?tag=trunk%3Bcontent&docid=1713105