New ransomware holds Windows files hostage, demands $50

The swindler convinces the mark to withdraw money from the bank

Cybercrooks have hit on a new twist to their aggressive marketing of fake security software, and are duping users into downloading a file utility that holds users' data for ransom, security researchers warned Wednesday.

While so-called "scareware" has plagued computer users for months, those campaigns have relied on phony antivirus products that pretend to trap malware, but actually only exist to pester people into ponying up as much as US$50 to stop the bogus warnings.

The new scam takes a different tack: It uses a Trojan horse that's seeded by tricking users into running a file that poses as something legitimate like a software update.

Once on the victim's PC, the Trojan swings into action, encrypting a wide variety of document types - ranging from Microsoft Word .doc files to Adobe Reader .pdf documents - anytime one's opened. It also scrambles the files in Windows' "My Documents" folder.

When a user tries to open one of the encrypted files, an alert pops up saying that a utility called FileFix Pro 2009 will unscramble the data. The message poses as an semi-official notice from the operating system: "Windows detected that some of your MS Office and media files are corrupted. Click here to download and install recommended file repair application," the message reads.

Clicking on the alert downloads and installs FileFix Pro, but the utility is anything but legit. It will decrypt only one of the corrupted files for free, then demands the user purchase the software. Price? $50.

"This does look like a new tactic," said David Perry, the global director of education for antivirus vendor Trend Micro Inc. "But all online fraud is just minor variations of classic con games. This is just the 'Bank Examiner' played out on the Internet."

That classic con, said Perry, typically involves a swindler posing as an official, a bank examiner or FBI agent, who asks for help in an investigation.

The swindler convinces the mark to withdraw money from the bank - it's needed to catch the non-existent crook in the act - and promises to return the funds at the end of the case. Of course, the money vanishes, along with the grifter.

On the Web, data hostage scams like this are called "ransomware," for obvious reasons. This isn't the first time the tactic's been used, but it is remarkably polished, said Perry. "We've not seen 'ransomware' with this level of sophistication," he said.

Users who have fallen for the FileFix Pro 2009 con do not have to fork over cash to restore their files, according to other researchers, who have figured out how to decrypt the data.

The Bleeping Computer site, for instance, has a free program called "Anti FileFix" available for download that unscrambles files corrupted by the Trojan. And security company FireEye Inc. has created a free online decrypter that also returns files to their original condition.

Alex Lanstein, a malware researcher at FireEye who blogged about FileFix Pro 2009 last week, called the turn from scareware to ransomware "sobering."

"Although we broke the encryption, it's a sobering realization of the state of malware that it is now actively extorting users by holding their data ransom," Lanstein said. "Despite this version of FileFix being trivial to crack, it does not bode well for the future of Internet malware."

If ransomware follows a similar path as scareware, criminals will be hustling to mimic FileFix Pro: According to some estimates, crooks make as much as $5 million a year pushing fake antivirus software.

Join the PC World newsletter!

Error: Please check your email address.

Tags ransomwaremalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?