Vundo Malware Encrypts Files & Charges To Decrypt


Recommended Posts

Vundo malware now encrypts users' files and then charges a fee to decrypt them

Mar 25, 2009 | 05:10 PM

By Tim Wilson

DarkReading

Researchers at security vendor FireEye have discovered that malware formerly used to push "scareware" is now being used to push "ransomware."

According to a

"Vundo has fundamentally altered its criminal business model from 'scareware' tactics to 'ransomware' extortion," blogs Alex Lanstein of FireEye's Malware Intelligence Lab. "While a user may be 'silly' to buy into scareware, they have little choice but to purchase the decryption software once the ransomware does its thing."

FireEye describes Vundo as a "generic Trojan" that sends a popup to Web users. In this case, however, Vundo is "pushing a piece of malware that encrypts various personal file types (.pdf, .doc, .jpg, etc.) on your system, and 'coincidentally' pushes a program called FileFix Pro 2009, which would decrypt them -- for a fee."

After studying the malware, FireEye developed a Perl script that will decrypt the files minus a fee. Users can upload their infected files to the the FileFix File Decrypter and receive back readable files. "In the coming days we'll be releasing a tool you can download that will decrypt all the affected files on your system," Lanstein blogs.

So far, none of the antivirus tools tested have been able to detect or eradicate the Vundo-borne malware because it is "polymorphic" and appears as a different executable file each time, FireEye says.

DarkReading - http://www.darkreading.com/security/attack...ttacks/breaches

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...