A new malware is out pretending to be part of CryptoLocker and using the same name in its lockscreen. This one displays a lock screen before you can access your desktop, blocks you from running any programs, and displays a box stating that you must fill out a survey in order to unlock your computer. It does not appear to encrypt any files and only blocks you from accessing your desktop. This is not a very professional looking malware, is coded in Visual Basic, and is probably the creation of a script kiddy. This malware was first reported here:
https://forums.malwarebytes.org/index.php?showtopic=140110
The text of the screenlocker is:
CRYPTOLOCKER WARNING
Your computer has been locked and all your files are encrypted with 2048-bit RSA encryption. In order to unlock your computer and files you need to fill out a survey.
You must use only REAL information while filling a survey (name, surname, address, phone number...). SMS mobile phone surveys unlock faster.
After completing a survey, you will download a txt file containing the needed code to unlock your computer and files.
Once the right key is entered, this message will disappear forever, your computer and files will be unlocked.
At the end there is an Open Survey button that brings you to a page hosted at totally-legit.biz. This page contains javascript to show you a survey widget from sharecash.org. Sharecash.org offers a survey widget that developers can use to unlock programs they offer if someone fills in the survey.
Do not worry, this one can be removed and it does not appear to encrypt your files.
https://forums.malwarebytes.org/index.php?showtopic=140110
The text of the screenlocker is:
CRYPTOLOCKER WARNING
Your computer has been locked and all your files are encrypted with 2048-bit RSA encryption. In order to unlock your computer and files you need to fill out a survey.
You must use only REAL information while filling a survey (name, surname, address, phone number...). SMS mobile phone surveys unlock faster.
After completing a survey, you will download a txt file containing the needed code to unlock your computer and files.
Once the right key is entered, this message will disappear forever, your computer and files will be unlocked.
At the end there is an Open Survey button that brings you to a page hosted at totally-legit.biz. This page contains javascript to show you a survey widget from sharecash.org. Sharecash.org offers a survey widget that developers can use to unlock programs they offer if someone fills in the survey.
Do not worry, this one can be removed and it does not appear to encrypt your files.
RSS Feed
