Spyware Warrior

CosmoKramer · Posted: Wed May 25, 2005 3:42 pm Post subject: Trojan Holds You Hostage.

If someone hasn't posted about it yet, there is a trojan out there which demands money for the decoder:

http://news.bbc.co.uk/2/hi/technology/4580389.stm

I think this is crossing the line!!!

Anti_Spyware · Posted: Thu May 26, 2005 5:49 pm Post subject:

Yes it is far stepping over the line....
I have heard about this earlier.
By the way, this is a side note, but has anyone heard of the most deadly virus? It didn't spread that much, and was written back in 2000 or so, by a guy in China. However, it alone had the ability to harm the BIOS and screw up the deepest levels of your computer. Fortunately there isn't a version of it written for newer comps like XP because the guy has been caught, I think.

ld · Posted: Sun May 29, 2005 7:43 pm Post subject:

I have been reading news stories on this for the past couple of days but other than that I haven't heard of anyone talking about this. Usually you hear people getting hit by this then going to a security mailing list and asking if anyone else has come across it... I remember reading a news story about 2 years ago about an offshore casino that got hacked and the attacker encrypted the drive or at least the important data. Then he offered to sell them the key to unlock it, his ransom was more than 200 dollars though. This company sent their drives off to another company that specialized in cryptography and they were able to recover the data.

Anti_Spyware: you are thinking of CIH aka Chernobyl. I think I would rate the witty worm worse. With CIH many people were able to reflash their BIOS but some did have to replace their motherboards. I don't recall CIH causing people to loose data though. The witty worm exploited several ISS products including firewall software. The worm was released within 24 hours of the patch. I try to keep my systems patched but hearing of a problem and having the patched installed within 24 hours takes luck with hearing about it at the right time. This worm deleted drives and it actually overwrote everything so recovery wouldn't be possible without spending a small fortune. I'm not even sure if that type of recovery is available to the private sector.