Wednesday, July 17, 2013

Ransomware - Fake "Government" Threats Demanding Money for "Crimes"

I’m still hearing reports of these types of incidents on a regular basis. Two neighbors had it happen and I just got a call from my mother’s coworker, so even after a year of widespread occurrences, it’s still coming up anew.

Here’s a great link that describes the topic of “ransomeware” from BleepingComputer. The image below is an example of what an infected system looks like, but recognize that there are many variations and various types of fixes required. You should also know that this has finally hit Mac OS X, although it’s a little less severe since the operating system protects the user from the more nasty types of damage that one of these things can cause.

HbBf0dN.jpg

How to know if you’re dealing with ransomware:

  1. Government threat of prosecution - the government doesn’t threaten to prosecute, they simply act and prosecute, especially for the crimes mentioned on most of these infections. If you were actually suspected of these things, you would probably already be in cuffs.
  2. The accusations - child pornography and exploitation of minors for sexual purposes are hardly light issues. Again, if someone in the federal government thought you were making child pornography, you’d be in cuffs (where you deserve to be) and hopefully rotting away in a jail away from the rest of us. The reason such a serious charge is listed is to scare you - into acting on the next point.
  3. Money demands - the feds do take a ton of our money in fees and taxes, but they don’t ask for you to wire cash via MoneyPak.

According to http://www.malwareremovalguides.info/your-computer-has-been-locked-ransomware-removal-instructions/ there are several paid programs that can remove this type of infection, but in the past I removed it with a little bit of hard work and time at no cost for software. The benefit of buying an application to protect your computer is that you can prevent this from happening again. The downside is, you have another layer of software running on your computer and slowing it down.

Overall, it is important to remember that Windows, even as late as Windows 7 (I have little experience with Windows 8, so I can’t comment on this aspect of it), is poorly designed and full of security holes that Microsoft does not seem to have on the agenda for a patch. The design of the Windows platform is so complex (and hasn’t been rewritten from the ground up in

Here is a good, simple manual guide to removing this latest iteration of the “your computer has been locked” virus/trojan: http://guides.yoosecurity.com/remove-mandiant-usa-cyber-security-virus/

Good luck!

No comments:

Post a Comment

Suggestions welcome! Is there a big story on one of those corporate tech blogs you'd like to see analyzed from the perspective of one guy? Send me the link!