View Full Version : Trojan attack takes files hostage

tlr online
26-05-05, 10:42
Virus writers have taken to extortion with malicious code that can hold documents on infected PCs hostage. The attack attempts to extort money from victims by encoding files on their PCs using a Trojan horse before requesting payment for a decoder tool.

The Trojan downloader (download-aag AKA Pgpcoder) exploits a well-known Internet Explorer vulnerability (MS04-023) to download hostile code onto vulnerable Windows boxes. It then searches for files with various extensions and encodes them. The original documents are deleted and the newly encoded files become unreadable. The malware also drops a message onto the system with instructions on how to buy the tool needed to decode the files, demanding payment of $200 from victims if they ever want to see their documents again.

The cyber extortion attack, first identified by net security firm Websense, represents a pernicious development in hacker tactics but with few documented cases there's no need to panic. Furthermore the attack relies on the download of code from a site which has since been taken offline. Nonetheless users would be wise to protect their systems and back up their data as a precaution against this type of attack.

www.theregister.co.uk (http://www.theregister.co.uk)

26-05-05, 11:21
What's interesting is if your original files are just deleted (i.e. the space formerly taken up by them is simply marked as available to write over), then theoretically, you should be able to clean your pc of the virus, and then recover your original unencrypted documents. In theory...

26-05-05, 12:52
Put it this way net, i would not like to test your theory, not if they encoded my Visual Basic code i am trying to get for tomorrw.

Which reminds me, i better make a copy now after reading that, lmao.

Smith will Suffice
26-05-05, 15:13
i HATED visual basic

i have nightmares of that friggin program still.