'Child porn' virus levies fines

[Bald Bouncer]

The virus uses a window crafted to look like it was issued by official agencies

German federal police are warning about a computer virus that accuses victims of viewing "juvenile pornography".

It also displays an image that it claims reveals images of child sexual abuse have been viewed on a computer.

The Windows virus locks a computer and only returns control to its owner on payment of a 100 euro (£86) fine.

It purports to be collecting cash on behalf of German copyright authorities and the country's national computer security agency.

The virus amounted to "digital extortion" and victims should not pay up, said German police.

The warning about the novel strain of ransomware was issued by Germany's Federal Criminal police office (the Bundeskriminalamt or BKA).

The ransomware version found by the BKA uses a pop-up window that says the machine has been locked down due to "unauthorised network activity". The window is crafted to look like it has been put together by Germany's Federal Office for Information Security (BKI) and its society for prosecution of copyright infringement (GVU).

'Emotional blackmail'

Text in the window claims that images of child sexual abuse as well as pirated content have been found on the machine. Also displayed is an picture of a child which it claims reveals illegal images have been viewed.

Rik Ferguson, director of security research at Trend Micro, said it was the first time he had heard of ransomware displaying images that users were accused of harbouring.

"It seems that they are attempting to increase the pressure of this kind of emotional blackmail," he told the BBC.

Germany's BKA said users should not pay the fine "under any circumstances" and added that neither the BKI or GVU collected cash in this way from those suspected of viewing illegal images or pirating content. Instead, users should use anti-virus and other security software to clean up their PC and deal with the virus.

"This is a form of digital extortion," said the BKA in its alert about the virus.

Ransomware, which tries to make victims pay an on-the-spot fine, is becoming more prevalent but most strains simply accuse people of pirating movies or music. Others scramble data that is only unscrambled when a fee is paid.

Security firm Symantec said it was seeing more and more strains of ransomware and said it could be "highly profitable" for its creators. It estimated that ransomware makers were already making about $5m (£3m) a year from such malicious code.

BBC News Technology

[evilsatan]

I have only come across one or two of similar infections so far, in one case it was a single user account affected so login to the other account, run rkill then mbam and it was sorted. Most Windows OS can have the Admin or Guest account enabled by using a tool such as Spotmau or Offline NT Password etc. so that could be used to remove the infection.

[nelly13]

cleaned a couple of the police ones for pirated stuff, bit of a pain in the jacksey but doable.

Not seen spotmau so will have a look

cheers

[aloogobee]

Wouldn't it be really easy to catch the guy that did this. Just look at where the payment is going

Sent from my GT-I9100 using Tapatalk 2

[koola2]

Saw one of these also for pirated stuff combofix sorted it, as normal.

[evilsatan]

Spotmau Powersuite has a few uses but I like it because it can clear Windows passwords and works on Win 7 x64 which some other tools fail on. It can also activate the admin/guest account. I think the password tools it uses must be from MSDaRT which I also have but Spotmau is efficient.