'Ransomware' tricks victims into paying hefty fines

I didn't see a security news section here like one over at seven so I'll post this here.

Beware of this new scam...

Computer users around the globe are being hit by a new kind of virus that freezes their computer and accuses them of committing heinous crimes, like distributing child porn. The threats sound real enough that victims are coughing up $200 to pay a "fine," and virus writer gangs are netting millions, security firms say.

The message that flashes across infected computer screens sounds downright scary:

"You have been viewing or distributing child porn ... violating article 202 of the Criminal Code of the United States of America," says one version, allegedly sent by the FBI. A virus victim supplied the message to NBC news.

Victims shouldn't pay the fine, Harrison said, but they should know that various software tools — including free tools available at Symantec — can rid their machines of the virus.

Source: 'Ransomware' tricks victims into paying hefty fines - Red Tape

 

[vrosa]

I'm using another antivirus based on my experience with Windows 7. Do you think it's a resource waste in Windows 8? Should I trust Defender as a solo AV? I really like Avast, but sometimes it sucks making some file operations unacceptably slow... especially under high load !

 

[Lee]

. . .just another dead horse. . .

 

[DoctorA]

@ All

Coke is better than Pepsi.

BTW, your article speaks of MSE, not Defender in 8. And do you really think one source is reliable?

I think Windows Defender in Windows 8 is the same as Microsoft Security Essentials.

Hi there.

Defender is different for it is written at kernel level according to what I read.

Thanks for the information. I was just going by my experience when I tried to download MSE from microsoft site got message was already on my computer and just had to be turned on. I went ahead and used Kaspersky Internet Security that came free with the computer from Costco. Appreciate your info in any case.

 

[Wenda]

I use a combo of Windows Defender and Malware-Bytes Pro. Seems to work well, at least I haven't had a problem so far.
But no anti-virus program is of any use unless you keep it up-to-date, and actually run it occasionally.

Wenda.

 

[Der Snoober]

But no anti-virus program is of any use unless you keep it up-to-date, and actually run it occasionally.

Wenda.

I second that motion there!!!

In my honest opinion there is no 1 AV program that works perfectly. It all comes down to a mix of a) an AV utility, b) think before you act, c) maintain your pc and that includes regular updates scans etc.


ps. I don't drink Coke or Pepsi....I'm a tea addict . Can we start a tea flame war

 

[Hopachi]

AV Wars Episode... lost the count.

Let's be honest, even the fastest computers out there: once online and with bad AV or multiple AV combinations will run slower that you expect them to. Defender is basic but works pretty well: when you copy files, they get scanned so the copy operation is slower (might say between 30% to 50% in some cases, SSD's don't feel it I guess) but this is way worse on Norton that seemed to be a big resource hog when I used it. Once I had BitDefender but always finding false-positives and with boot degradation of 50s each time, I don't use it anymore.

Even if some of these AV's latest versions rock to some, to me they don't rock, they ARE rocks feeling heavy on my OS.
Depends what sites you visit but to me a minimal defender works.

Despite the slowdowns a decent protection is essential.
Everyone uses what they think is best.

 

[dencal]

But no anti-virus program is of any use unless you keep it up-to-date, and actually run it occasionally.

Wenda.

I second that motion there!!!

In my honest opinion there is no 1 AV program that works perfectly. It all comes down to a mix of a) an AV utility, b) think before you act, c) maintain your pc and that includes regular updates scans etc.


ps. I don't drink Coke or Pepsi....I'm a tea addict . Can we start a tea flame war

You have not got a clue regarding an opinion as to which AV prog is best any more than I have.
Leave it to the experts ie- the two named AV testing sites who are not employed by any AV companies.
They work completely independently and make their money by selling this information to computer periodicals, newspapers and companies, and are recognised universally throughout the world as the real experts.
Hopefully this will put an end to all the so called posters on this forum giving their so called expert opinions.

 

[Hopachi]

Hopefully this will put an end to all the so called posters on this forum giving their so called expert opinions.

If you only keep looking at charts you'll loose the grip...
Also test things for yourself and use what best suits you: are you pleased with the performance?

I've checked av-test and then cnet following three good products (I don't give any names, check for yourself).

They forgot one line: the performance and stats of an 'unprotected' system without any new AV, which was very well mentioned on cnet (basically no AV or with Defender on Win8).

Here's why I won't be buying AV's from this year on:


Even the most performant ones have 50% boot and usage slowdown. I've already said that but this time with proof.

Buy what you like.
As a home user, some new product won't convince me anymore. End of story.

 

[XweAponX]

Oh Ghod I have had dealing with this exact virus. The question is how is it delivered, popup.under? page click? fake download from sendfile?

I download a lot of files from sendfile personal things friends share with me, usually images or old programs I'm asking for. they only stay up long enough for me to download then are deleted.

I've seen this happen a few times, there is a Captcha for any legit sendspace download. After that, it directs you to a page from where you can download the file. What I noticed was the file I downloaded was named exactly what my source said it would be, but the file extension would be EXE instead of the usual RAR. At first I thought they were sending me a self extracting RAR, but I held off. The file contained Zoomex or other of the billions of Virii I have to avoid.

What happens is, somehow the download link is appropriated, and you download this virus instead. The download page is an exact duplicate of the actual Sendspace page.

I finally got wise to this when my Malwarebytes started blocking the pages, when I checked on actual link, it was not really a sendspace page, it was from somewhere else. This has been happening a lot lately so I always double check all downloaded files.

Search! It is some kind of search engine hijack. Somewhere in between clicking the link I was send and the actual page, I was redirected to the fake page. Because I also noticed that clicking the link again brought me to the real sendspace page and the subsequent download was the right file.

 

[jimbo45]

I'm a computer tech and with all viruses we remove the hard drive and slave it to antother machine. We then scan the hard drive with a variety of antivirus and malware scanners. Once done we put it back int he machien and again run scans which generally then pickup the various registry entries.

Hi there
As a computer Tech - I'm surprised you would even THINK of using AV removal software -- there are only two 100% safe ways and that is EITHER restore the defective OS from a CLEAN image OR Re-Install from scratch. You would have the expertise (and the time) to do this even though some typical users wouldn't be able to do it themselves.

I'd also for each Boot on the customers machine issue a warning -- HAVE YOU TAKEN A BACKUP YET and keep issuing that message until a backup has been performed.

In any case all those people who also quote from magazine articles about the effectiveness of AV product 1 vs AV product 2 etc should remember that all those statistics are TOTALLY OUT OF DATE by the time they are published -- a new infection could appear AT ANY TIME rendering the previous results and statistics TOTALLY AND UTTERLY USELESS.

Windows defender for Windows 8 is built in to the kernel --it's based on MSE but is NOT identical -- and it works probably just as good as any of the other 3rd party stuff out there - and probably better.

Remember also that a lot of those rubbish AV statistics are based on Windows 7 which is also 100% IRRELEVANT as far as Windows 8 is concerned.

In any case people use computers in totally different ways so it's almost impossible to quantify a "General Risk". - I've been using PC type computers for nearly 40 years, have "done Torrents" etc and have NEVER had a computer infection -- so the best defence is still undoubtedly YOU the USER.

Cheers
jimbo

 

[pparks1]

As an IT tech, when we work with other peoples computers, we find they don't have images or backups. So, that is why we sometimes have to fight to "remove" what happened to them rather than restoring an image or starting from scratch.

As far as whether Microsoft Security Essentials/Windows Defender is great, bad, basic or full featured...well I think we all realize that it is a free product and is intended to provide an adequate level of protection for the greater user base. I would think it goes without saying that if you torrent, pirate, surf porn or do lots of questionable things on the net, you probably realize that you should "invest" in a more fully features bells and whistles type product. It's pretty common on the web to find that MSE/Defender has not been ranked at the top: Microsoft Security Essentials Tanks Another Antivirus Test. For my surfing habits, a low/no cost basic option is sufficient.

As far as this randomware goes, I've seen it once before myself. My boss is currently dealing with it on his son's home computer.

 

[Brink]

   Warning

Let's keep this discussion friendly shall we.

 

[XweAponX]

If I were the admin of a pool of 100 computers, I would simply do as the one gentleman says and just wipe the drive, zero-write it, and reinstall from whatever main backup there is. I would make a policy that personal files should not be in there and all important work be automatically backed up into the server. I can't do that with the systems I maintain though.

I admin networks that have up to 5 computers hooked up to a central machine which serves up the Databases. It's mostly Automotive Repair libraries and systems to keep track of the work, usually MySQL, one of them is based on Microsoft MDB files. I've been taking care of these systems for the last 12 years, so I have to make sure the server as well as all of the workstations do not get infested, because there are no backed up system images to use for a restore, it's Windows XP and 7 and Server 2003 usually, so any wipe and reinstall is problematic.

After the years have gone by, the users have stopped looking at Pron, I explained to them that it is more cost effective if I don't have to come out every few days and clean viruses out, so they have been behaving themselves. Mostly the owners of those places do the retribution when I have to come out and clean out muck they have downloaded. I had to clean out the exact virus which is the subject of this original thread, just 3 weeks ago. But one week after that, Malwarebytes released that bad definition file which caused the program to wipe system files, so I had to go back out and do system restores back to the day I had removed the fake "locked" virus, and then remove it again. On Windows 7 machines this was devastating, because it could not be booted in any mode to bring up System Restore, I had to restore from the install disk on about 15 machines- That little error of Malwarebytes gave me almost a week and a half of work. The Malwarebytes thing was a fluke, but the malicious program that causes this fake lock out, well it is just mean programming. Even if you pay them money to unlock you, you do not really get unlocked.

 

[sygnus21]

Even if you pay them money to unlock you, you do not really get unlocked.

Yeah that was a question I had. Who's to say you'll be unlocked? But than again, this is another part of the scam... hope. Hope that you'll get your computer back. That along with fear makes this a very nasty malware program.

 

[XweAponX]

Exactly - Remember, these are VIRUSES. Some of the people who make them are very clever. The reason why so many viruses appear that open a continuous stream of Pornographic web pages is simply because the pages belong to the guy who made the virus and the more hits on pages with ads, the more money they make. You'll notice that the pages that come up are all on the same site or are similar in other ways. This is in fact why the Porn pages always have popups popunders, and other exploits and trick you into clicking on links that install these viruses that open page after page after page of pron.

But this new "Lockout" thing - This is part of a recent development in virus manufacturing where the idea is to TRICK you into installing a Fake AV program, which in turn installs, possibly harmless files, which the fake AV reports as viruses. But the programs will not delete the files unless you "buy" it and unlock the cleaning function. But day after say, new fake viruses are created by the program itself so you have to keep using it and keep sending them more money. On the other hand, maybe the idea was simply to get your credit card info.