Zeus Trojan variant comes with ransomware feature

A place to talk about relax topics, such as tailwaggers and jokes unrelated to our products, politics and religion. Please keep it clean.

Zeus Trojan variant comes with ransomware feature

Postby vita » 2012-05-23 0:49


The recent popularity of ransomware as a tactic for duping users into giving up their hard-earned cash has resulted in an unexpected malware combination.

F-Secure researchers have recently spotted a new Zeus 2.x variant that includes a ransomware feature.

Once this particular piece of malware is executed, it first opens Internet Explorer and points it towards a specific URL (lex.creativesandboxs.com/locker/lock.php). Simultaneously, the users are blocked from doing anything on their computer.

The site in question is offline, so it is difficult to say for sure what it contained, but a good guess would be an extortion message.

The command for "unlocking" the computer is present on the computer, in the registry, so it is possible to do so without paying the ransom.

According to the researchers, users who have found themselves effectively locked out of the computer must do the following:

1. boot the system in safe mode
2. add a new key named syscheck under HKEY_CURRENT_USER
3. create a new DWORD value under the syscheck key
4. set the name of the new DWORD value to Checked
5. set the data for the Checked value to 1
6. reboot


Obviously, the threat of having their financial and login information stolen after having unlocked the computer is still present, as the aforementioned steps haven't rid them of the malware.

News source: -http://www.net-security.org/malware_news.php?id=2120-
User avatar
vita
Advanced Member

Advanced Member
 
Posts: 155
Joined: 2012-02-01 3:06

Re: Zeus Trojan variant comes with ransomware feature

Postby canova » 2012-05-23 1:03

:( That's destructive.
User avatar
canova
Regular Member

Regular Member
 
Posts: 61
Joined: 2012-05-18 4:39


Return to General Chat

Random Threads
ThreadThread StarterViews
Черная пятница UGG Металлические высокие сапоги 5812 Outlet Интернетturethann0
Increased Digital Sales Drive Presstek to Record Revenue: Summary of Second Quarter 2006 Earnings CallMichaelaberm0
Millions of LinkedIn passwords reportedly leaked onlinequeen3697
Tiffany Outlet Double Solid Cross Silver Set [10f5] - $95.00 : Professional tiffany outlet stores, jewelrylove.cnlragelollie0
breitling bentley motors tlragelollie0

Who is online

Users browsing this forum: No registered users