Ransomware demands payment for alleged copyright infringement
Infected users are asked to pay £50 or their computer will remain locked
By Jeremy Kirk | Published: 16:11, 08 May 2012
A new wave of malware freezes a computer and demands payment to unlock it, this time falsely alleging victims have infringed copyright.
The campaign, spotted by Roman Hussy, who authors the abuse.ch blog, targets users in the UK, Switzerland, Germany, Austria, France and the Netherlands.
Hussy posted a screenshot of the warning that users in the UK would see. It bears the logos of the Performing Right Society (PRS), a royalties collection organisation, and the Metropolitan Police.
Related Articles on Techworld
It falsely alleges that material protected by copyright has been found on the computer and subsequently has been moved to an encrypted folder "to prevent further damage."
"To unlock your computer and to avoid other legal consequences, you are obligated to pay a release fee of £50," it reads.
The ransom can be paid with Paysafecard, a prepaid payment card offered throughout Europe and a few other countries such as the US. Hussy wrote the scam's perpetrators even included information on where victims could purchase a Paysafecard.
The type of malware, known as "ransomware," is nothing new, but the methods for manipulating users into paying change frequently. Hussy wrote in early March that a similar ransomware falsely warned of child pornography on a computer, demanding a £100 fine.
In this latest version, users can be infected with the ransomware if they visit a website that has been hacked to serve up the Blackhole exploit kit. The kit tries a handful of exploits on a user's computer, and if vulnerable software is found, can infect it with malware.
Depending on where the user is located, the appropriate local page is delivered. Hussy wrote that he suspects whomever is behind the campaign is German due to the German words in the URLs in localised versions of the scam.
In addition to locking up a computer, the malware also contains a component called Aldi Bot, which can steal online bank account credentials and conduct distributed denial-of-service attacks, Hussy wrote.