'Ransomware' tricks victims into paying hefty fines

I didn't see a security news section here like one over at seven so I'll post this here.

Beware of this new scam...

Computer users around the globe are being hit by a new kind of virus that freezes their computer and accuses them of committing heinous crimes, like distributing child porn. The threats sound real enough that victims are coughing up $200 to pay a "fine," and virus writer gangs are netting millions, security firms say.

The message that flashes across infected computer screens sounds downright scary:

"You have been viewing or distributing child porn ... violating article 202 of the Criminal Code of the United States of America," says one version, allegedly sent by the FBI. A virus victim supplied the message to NBC news.

Victims shouldn't pay the fine, Harrison said, but they should know that various software tools — including free tools available at Symantec — can rid their machines of the virus.

Source: 'Ransomware' tricks victims into paying hefty fines - Red Tape

 

[sygnus21]

So it's more difficult than I thought, no Ctrl Alt Delete, Task Manager settings... Since I never encountered it I don't know the difficulty level.
RESET - FORMAT/RESTORE remains the safest way in the end.

I don't trust cleaners. If this thing is really complex and well-made, it might trick some cleaners/AV and restore/copy itself back to positions in no time. Should you still use a network or internet connection then it even gets worse. Removing the network connection/cable or stop wifi is the first thing to do after you see the warning screen.

Well the article did say virus companies are working on it, and hopefully someone has developed a more effective way to get rid of it.

 

[HippsieGypsie]

I would like to ask which browser(s) were in use when this nasty was caught from people who have experienced/fixed them?

It was a few months back and my memory escaped me. I need to correct stating it was 7. It was actully Vista and without SP1 or SP2! Ugh!

This machine was given to him by a friend without disks. He's not computer savvy whatsoever and he's just a "consumption" user. I believe he was using Chrome, but I don't know which version. I'm sure it wasn't updated. I don't think it would've mattered what browser he was using. Nothing was updated, not even the 3rd party AV. This machine was like an open sore inviting viruses in! There was IE8 on it, of course, but eventually upgraded that to IE9.

Once I rid it of this ransomware virus (thank the lucky stars there were good restore points), the machine ran as slow as molasses in the Artic Circle. Vista + 3rd party AV + 1GB RAM = S.L.O.W. LOL! I don't know how this man used this machine as long as he did! Either he hasn't used a good one before, doesn't know how fast a machine can run, or he has patience of a saint!

When I opened Programs and Features to uninstall the AV I couldn't believe what I saw! 3 (Yes, three!) AVs and about 40 other programs! I sat there with him and went through the list uninstalling those he didn't use. About 30/35 of them. Rebooted when needed. Ran CHKDSK during one. I downloaded CCleaner and ran the temp cleaner and registry repair. I upgraded IE, downloaded MSE, and ran a scan. Performed a DeFrag. Installed SP1/SP2/updates. The machine ran much, much faster.

I advised him that he should look into upgrading and max to 2GB RAM and if possible to Windows 7 or 8. I also suggested he find cleaner sites to surf.

About a solution if no Safe Mode > The article stated:

Victims shouldn't pay the fine, Harrison said, but they should know that various software tools — including free tools available at Symantec — can rid their machines of the virus.

I looked on the Symantec site, but cannot find a link to their support? Anyone know?

Microsoft has Windows Defender Offline. Not sure if it will remove it:

What is Windows Defender Offline?

More on the subject:

Ransomware removal | What is Ransomware | Microsoft Security

Which has a link to here:

Ransomware

Like Hopachi stated, this thing is quite sophisticated. It may take a lot to remove it.

 

[revmike]

My daughter had this happen to her laptop, with vista as the os. Malwarebytes pro was useless. Hitman pro free edition took care of it.

 

[sygnus21]

About a solution if no Safe Mode > The article stated:

Victims shouldn't pay the fine, Harrison said, but they should know that various software tools — including free tools available at Symantec — can rid their machines of the virus.

I looked on the Symantec site, but cannot find a link to their support? Anyone know?

I just posted what the article said, but hadn't looked at Symantec's site. Incidentally I just got Norton Internet Security about 3 days ago for my lappy as I didn't like the fact that MSE under Windows 8 doesn't allow right click scanning like it does under Win 7.

Plus, for my lappy I feel a bit better with Norton than with MSE since the lappy is more prone to attacks. I like MSE, but when you're in school and sharing thumb drives all over the place, well...

Anyway I'm sure Symantec like all the others will find a way to handle this latest threat... for now

 

[jimbo45]

So it's more difficult than I thought, no Ctrl Alt Delete, Task Manager settings... Since I never encountered it I don't know the difficulty level.
RESET - FORMAT/RESTORE remains the safest way in the end.

I don't trust cleaners. If this thing is really complex and well-made, it might trick some cleaners/AV and restore/copy itself back to positions in no time. Should you still use a network or internet connection then it even gets worse. Removing the network connection/cable or stop wifi is the first thing to do after you see the warning screen.

Well the article did say virus companies are working on it, and hopefully someone has developed a more effective way to get rid of it.

Hi there
100% effective way to get rid of it: Works EVERY TIME. About 20 mins max and Job Done.

Wipe the disk and restore from a CLEAN backup image with a BOOTABLE stand alone backup / restore program like acronis.

Use Partition Magic (bootable) or similar to wipe the disk --don't use any AV software for cleansing -these can never be 100% guaranteed to be effective and the computer is already infected. Don't do the disk re-format / partitioning from within Windows itself as it's already infected so how would you be sure windows was working properly.

If you haven't got a backup -- "Tough Ladies Accoutrements... " Serves you right so learn for next time.

Forget Symantec -- It's as about as USELESS in the AV field as GARTNER is in forcasting computer developments. Anyway on Windows 8 you DON'T NEED ANY 3rd party AV - the built in Windows defender is just as effective as ANY of the other ones and if you do install a 3rd party AV software the Ms version stops working and in any case things like Symantec and McAfee (we know it as McAWFUL) are just RESOURCE HOGS.


Cheers
jimbo

 

[sygnus21]

Forget Symantec -- It's as about as USELESS in the AV field as GARTNER is in forcasting computer developments. Anyway on Windows 8 you DON'T NEED ANY 3rd party AV - the built in Windows defender is just as effective as ANY of the other ones and if you do install a 3rd party AV software the Ms version stops working and in any case things like Symantec and McAfee (we know it as McAWFUL) are just RESOURCE HOGS.

Ahh, the ole this AV that AV sucks opinion. Everyone's got one I suppose.

(exits before the house burns down)

 

[Lomai]

Forget Symantec -- It's as about as USELESS in the AV field as GARTNER is in forecasting computer developments.

Cheers
jimbo

Classic, Jimbo, classic !

 

[Hopachi]

So it's more difficult than I thought, no Ctrl Alt Delete, Task Manager settings... Since I never encountered it I don't know the difficulty level.
RESET - FORMAT/RESTORE remains the safest way in the end.

I don't trust cleaners. If this thing is really complex and well-made, it might trick some cleaners/AV and restore/copy itself back to positions in no time. Should you still use a network or internet connection then it even gets worse. Removing the network connection/cable or stop wifi is the first thing to do after you see the warning screen.

Well the article did say virus companies are working on it, and hopefully someone has developed a more effective way to get rid of it.

Hi there
100% effective way to get rid of it: Works EVERY TIME. About 20 mins max and Job Done.

Wipe the disk and restore from a CLEAN backup image with a BOOTABLE stand alone backup / restore program like acronis.

Use Partition Magic (bootable) or similar to wipe the disk --don't use any AV software for cleansing -these can never be 100% guaranteed to be effective and the computer is already infected. Don't do the disk re-format / partitioning from within Windows itself as it's already infected so how would you be sure windows was working properly.

Yes. This is what I think as well. You can use the built-in image recovery system. Win8 has 2 ways of imaging, the one I use is the Win7 File Recovery because I'm accustomed to it and never failed me. Third party: I believe Acronis is one of the best available, you also have Macrium and Todo Backup as well.

If you haven't got a backup -- "Tough Ladies Accoutrements... " Serves you right so learn for next time.

It's true, always have a backup because the OS is not made of steel and the user's mistakes cannot be predicted by the system.

 

[DavidY]

Not saying they deserved it, just saying that I would think sites like those are more vulnerable to this sort of crap; though it can happen to anyone who just happens to open a nefarious file or visit a strange site.

I agree it's more likely on that sort of site; however even reputable sites get hacked from time to time. Even if you stick to reputable ones, if you're unlucky there could still be something nasty hiding there.

 

[dipper]

I'm a computer tech and with all viruses we remove the hard drive and slave it to antother machine. We then scan the hard drive with a variety of antivirus and malware scanners. Once done we put it back int he machien and again run scans which generally then pickup the various registry entries.

 

[HippsieGypsie]

Hi there
100% effective way to get rid of it: Works EVERY TIME. About 20 mins max and Job Done.

Wipe the disk and restore from a CLEAN backup image with a BOOTABLE stand alone backup / restore program like acronis.

Use Partition Magic (bootable) or similar to wipe the disk --don't use any AV software for cleansing -these can never be 100% guaranteed to be effective and the computer is already infected. Don't do the disk re-format / partitioning from within Windows itself as it's already infected so how would you be sure windows was working properly.

If you haven't got a backup -- "Tough Ladies Accoutrements... " Serves you right so learn for next time.

Forget Symantec -- It's as about as USELESS in the AV field as GARTNER is in forcasting computer developments. Anyway on Windows 8 you DON'T NEED ANY 3rd party AV - the built in Windows defender is just as effective as ANY of the other ones and if you do install a 3rd party AV software the Ms version stops working and in any case things like Symantec and McAfee (we know it as McAWFUL) are just RESOURCE HOGS.

Cheers
jimbo

A lot of good advice here, but jimbo's advice I think to be best both time and efficiency wise. Clean, certain, and fast.

I'm sitting here wondering if the crap is sitting on this customer's machine or not. Even in part. Who knows what this thing befalls us?

It gets to be chasing good money after bad on these older machines for these people. I'll give him all the options. I'll quote him a very fair price since I feel I didn't do it 100% the first time.

- I'll offer him to perform a clean install, load programs he likes, and perform a mirror image.
- Upgrade RAM. That'll make a big difference for the buck in this case.
- If looking at upgrading the OS, one may as well chuck the machine and buy new IMO, but I'll give him that option.
- Or simply do nothing.

I realize to each their own, but, so far as AV is concerned, I'll stick with jimbo (and others) on that, too. Business is a different scenario, but for home use, one can't beat the price of Defender or MSE. I hear it out of azasadny as well. He does AV testing for a large corp as a profession.

Art's OP, #12, and #16 posts here: http://www.eightforums.com/system-security/22437-symantec-windows-8-sales-stuff.html

 

[dencal]

So it's more difficult than I thought, no Ctrl Alt Delete, Task Manager settings... Since I never encountered it I don't know the difficulty level.
RESET - FORMAT/RESTORE remains the safest way in the end.

I don't trust cleaners. If this thing is really complex and well-made, it might trick some cleaners/AV and restore/copy itself back to positions in no time. Should you still use a network or internet connection then it even gets worse. Removing the network connection/cable or stop wifi is the first thing to do after you see the warning screen.

Well the article did say virus companies are working on it, and hopefully someone has developed a more effective way to get rid of it.

Hi there
100% effective way to get rid of it: Works EVERY TIME. About 20 mins max and Job Done.

Wipe the disk and restore from a CLEAN backup image with a BOOTABLE stand alone backup / restore program like acronis.

Use Partition Magic (bootable) or similar to wipe the disk --don't use any AV software for cleansing -these can never be 100% guaranteed to be effective and the computer is already infected. Don't do the disk re-format / partitioning from within Windows itself as it's already infected so how would you be sure windows was working properly.

If you haven't got a backup -- "Tough Ladies Accoutrements... " Serves you right so learn for next time.

Forget Symantec -- It's as about as USELESS in the AV field as GARTNER is in forcasting computer developments. Anyway on Windows 8 you DON'T NEED ANY 3rd party AV - the built in Windows defender is just as effective as ANY of the other ones and if you do install a 3rd party AV software the Ms version stops working and in any case things like Symantec and McAfee (we know it as McAWFUL) are just RESOURCE HOGS.


Cheers
jimbo

Hi Jimbo.

You talk a lot of sense most of the time but every now and then WHOOPS....Windows Defender....unless you know more than respected AV security testing sites such as AV Test and AV Comparatives. You are giving unwarranted credit to WD when in reality
its protection is abysmal.

 

[Der Snoober]

Hi Jimbo.

You talk a lot of sense most of the time but every now and then WHOOPS....Windows Defender....unless you know more than respected AV security testing sites such as AV Test and AV Comparatives. You are giving unwarranted credit to WD when in reality
its protection is abysmal.

Do you have proof about that? I think that Windows Defender is a great Antivirus tool. And wouldn't Microsoft be the company to now best how they can defend their OWN product?

So, I'd like te see some evidence before accepting these allegations.

Greetz,

Rover

 

[dencal]

Hi Jimbo.

You talk a lot of sense most of the time but every now and then WHOOPS....Windows Defender....unless you know more than respected AV security testing sites such as AV Test and AV Comparatives. You are giving unwarranted credit to WD when in reality
its protection is abysmal.

Do you have proof about that? I think that Windows Defender is a great Antivirus tool. And wouldn't Microsoft be the company to now best how they can defend their OWN product?

So, I'd like te see some evidence before accepting these allegations.

Greetz,

Rover

Simple...Google the two AV testing sites I have named and look at the results....All the proof you need.

 

[Der Snoober]

Simple...Google the two AV testing sites I have named and look at the results....All the proof you need.

No offence there....but I can put up a site that says all of different things. So, just one or two random sites doesn't say much to me.

 

[SIW2]

MS said it was basic protection.

I have no idea why some people leap to different conclusions.

Here is another review, from a respected source:

No roundup of free security software is complete without Microsoft’s own free antivirus tool. Sadly, a very poor performance in our malware detection tests means Security Essentials is one option we can’t recommend.

Best free antivirus for 2013 | Buying Guides | Features | PC Pro

 

[sygnus21]

Like I said, let the flame wars begin with the my AV is better than yours "facts"; err... I mean opinions

 

[HippsieGypsie]

@ All

Coke is better than Pepsi.

MS said it was basic protection.

Where did MS ever state this? MS takes AV and computing safety very seriously. They have a whole site dedicated to teaching users how to keep there devices safe. I don't see other companies with sites such as this. Admittedly no AV is 100%, but teaching people safe surfing is more important IMO, for after all we are our own best AV with safe surfing and safe computer-use habits.

Defend Your Computer

No one seems to mention this. For business if one doesn't feel safe with MSE solely:

Microsoft System Center 2012 | Endpoint Protection

I have no idea why some people leap to different conclusions.

Here is another review, from a respected source:

No roundup of free security software is complete without Microsoft’s own free antivirus tool. Sadly, a very poor performance in our malware detection tests means Security Essentials is one option we can’t recommend.

Best free antivirus for 2013 | Buying Guides | Features | PC Pro

BTW, your article speaks of MSE, not Defender in 8. And do you really think one source is reliable?

 

[DoctorA]

@ All

Coke is better than Pepsi.

BTW, your article speaks of MSE, not Defender in 8. And do you really think one source is reliable?

I think Windows Defender in Windows 8 is the same as Microsoft Security Essentials.

 

[HippsieGypsie]

@ All

Coke is better than Pepsi.

BTW, your article speaks of MSE, not Defender in 8. And do you really think one source is reliable?

I think Windows Defender in Windows 8 is the same as Microsoft Security Essentials.

Hi there.

Defender is different for it is written at kernel level according to what I read.