New Ransomware Blocks Internet Access

[RicheemxX]

A nasty piece of ransomware has been discovered that block a computers internet access and demands and activation code to return a users control.

The trojan, dubbed 'Win32/RansomSMS.AH', is bundled with software named uFast Download Manager. Once downloaded the software was installed in the background without informing users. The trojan then hijacks your pc settings and begins blocking internet access demanding an activation code. This activation code is obtained by sending an SMS containing a particular number to an expensive premium rate phone number.

CA ISBU created an activation code generator that works to circumvent the activation scheme for this particular ransomware. As of yet there was no word on actual removal tools.


Source: CA Security Advisor Research Blog

Via my blog

[SeanC]

Nasty stuff. Not sure I'd use removal tools on something like that.

It would be a straight format and low-level wipe of the drive and hope the people had a good, recent backup.