New ransomware tricks with bogus Windows activation

Email LinkedIn
Tools

A new Trojan has been spotted that tries to scare by a series of messages that attempt to emulate Microsoft's (NASDAQ: MSFT) activation process. As reported by Computerworld, an infected computer will see a message that states: "This copy of Windows is locked. You may be a victim of fraud or there may be an internal error."

Users are then offered the option to reactivate their systems either online or via a phone call. However, the former has been rigged not to work, leaving a phone call to an assorted list of overseas numbers as the only options. According to security vendor F-Secure, users who encounter the message will not be able to boot their machines in either normal or safe mode.

While the Trojan assures that the overseas call is listed as "free of charge," the telephone number actually leads to an automated call center where users end up racking long-distance charges by being put on hold for about three minutes. In a racket called "short stopping," the perpetrators work together with rogue phone operators that make money by pocketing the difference between high-priced destinations billed to victims, and the cheaper countries that the calls are actually routed to.

F-Secure has delivered the unlock code as part of its investigations, which the company says appears to be the same: "1351236."

For more on this story:
- check out this article at Computerworld
- check out this article at F-Secure

Related Articles:
Network World apologizes to Samsung over false keylogger accusation 
Websense posts update on LizaMoon SQL injection malware campaign 
Lessons learned from the Samsung malware that wasn't 
Cybercriminals peddling exploit kits as hosted service