Wednesday 30 January 2013

Old school fraud masquerading as something official


2012-12-27 12.09.20
If you're here looking for a solution to the Your Computer Has Been Locked banner screen then this article should give some general pointers and info. Please comment if you have something constructive to add or found this article to be helpful.

This is a new twist in the type of malware infection that’s on the loose at the moment. Everything about this rogue app is designed to intimidate its unsuspecting victims (there have been many) into believing that there’s something official about the basis for his or her pc being locked. However it’s nothing more than theft, fraud, crime or whatever seems most appropriate to describe this kind of low-life activity.
In this example the computer has been well and truly hijacked and with no apparent way of getting rid of the on-screen message or regaining control of the infected pc. Furthermore the victim is being asked to send a payment of 100GBP to buy the release. Alas the needed solution will not be found by making the payment. Instead it’ll result in the criminals behind this fraud getting credit card and, most likely, other valuable personal information with which to attempt to commit further crimes.
The solution here is to find the most appropriate way to clear the infection from the pc without having to completely wipe the system with a reinstall of Windows. So we turn to using one or possibly more anti-malware apps.
The above pc, running Windows Vista, had to be restarted into safe mode to enable the necessary control to be regained. Having got this far it was then possible to use SurfRight’s HitMan Pro to perform a scan of the infected pc. Multiple infected files in various locations on the hard drive were discovered and cleaned. Further infected files were detected during a subsequent scan using MalwareBytes Antimalware scanner.
Perhaps not all of those infected files were associated with the ransomware but, of course, all needed to be removed for obvious reasons.
Following this disinfection the pc could be restarted normally with no apparent damage to the Windows operating system, user data or the installed apps. A lucky escape? Not so easy to discover is what information may have been harvested from the infected pc. So follow-up actions include resetting passwords on all important accounts. e.g. online banking and shopping. The other priority follow-up was to invest in better internet security software. Kaspersky and BitDefender are the vendors of what is considered to be the best currently available.
It’s priggish to say this, I know, but prevention is always better than cure!

No comments:

Post a Comment