New Ransomware Trojan Makes the Rounds

It's been a while since we have seen a good Ransomware trojan. It is too bad for the criminals who wrote this new trojan that they can't spell.

Back in March, 2006 a worm named Cryzip was discovered. If your PC got infected with this worm it would look for files on your PC with certain extensions (.doc, .xls, and .zip, to name a few) on your C drive, encrypt them and leave a text file behind which described how you could get your files back if you paid a $300 "ransom" to an e-gold (anonymous online money transfer service) account.

This new trojan works a bit differently. The new ransomware effectively locks up your PC and demands that in order to get control back you must send $35 (apparently ransoms don't fetch what they used to) to get it back. The cyber criminals probably figured that the $35 figure was low enough such that people would feel that it was easy enough to pay.

The infected machine is also displays an error message window that has the title of "ERROR: Browser Security and Antiadware [sic] Software component license exprited [sic]" Funny...I didn't know my browser security could exprite! This window also tells you that surfing porn and adult sites without security software is "dangerows". Oh no! I don't know what "dangerows" is, but I am pretty certain I don't want any of it!

If you click to activate a new license in the error window you are presented with this window which displays a 1-900 number and a PIN to enter when you call (the cost of the call is $35).

The biggest weakness with Cryzip which used a low-grade encryption key which was actually posted online by security researchers which essentially rendered the trojan and its extortion technique useless. Maybe someone will pay the $35 to unlock their PC infected with this new trojan and post the cleaning instructions online? :)