Trojan Demands "your Money Or Your Windows!"

[Peaches]

23 April 2009, 11:22

[b]Trojan demands "Your money or your Windows!"

Several anti-virus software suppliers are reporting a new kind of trojan that locks users out of their Windows PCs until they pay a ransom. Dr.Web says that "Trojan.Winlock", under the guise of a video codec, is so far only circulating in the Russian part of the world wide web. It gets into a computer via a download, then manipulates it so that on start-up the user is confronted with a (Russian) dialogue giving instructions for unlocking the machine. This involves sending a given numeric string to a highly priced premium SMS number in order to get the release code.

To unlock you need to send an SMS with the text xxxxxxxxxxxxxx to the number

3649

Enter the resulting code:

Any attempt to reinstall the system may lead to loss of important information and computer damage

In contrast to the GPCode encryption trojan and its successors, Trojan.Winlock doesn't manipulate files, but merely blocks access to the desktop and applications. A clued-up user could simply insert a boot CD to skip the problem, access his files and remove the trojan, but anyone less savvy might boggle at this and choose to pay up. In its Annual Threat Report in March, Trend Micro was already speculating about a probable upswing in ransomware attacks in the second quarter of this year.

Full story - Heise security - http://www.h-online.com/security/Trojan-de...s--/news/113134