Reports are coming in of a Trojan that demands a ransom from users and threatens to delete data if payment is not made.

Troj/Ransom-A threatens to delete one file belonging to the user every 30 minutes, until the $10.99 ransom demand is fulfilled. The Trojan is spreading as a disguised file on peer-to-peer networks and may also have been spammed out.

Once the file is activated it displays pornographic images and the following message: 'Listen up muthafucka. is this computer valuable. it better not be. is this a business computer. it better not be. do you keep important company records or files on this computer. you'd better hope not. because there are files scattered all over it tucked away in invisible hidden folders undetectable by antivirus sofware the only way to remove them and this message is by a CIDN number.'

The 'CIDN number' can be obtained by putting the cash in a Western Union account and the writer includes his email address in case any of his victims have problems with the installation. Police are investigating both leads.

"This one's not the smartest tool in the box," said Graham Cluley, senior technology consultant for Sophos. "We've passed the details on and the police are looking into this one."

The code has a number of other taunts for the infected. If the user tries to shut down the PC using Control Alt Delete the malware blocks the action and displays a new message.

'Yeah, We don't die, We multiply! Ctrl+Alt+Del isn't quite working today, is it? I'm not the sharpest tool in the shed but Crtl+Alt+Del is everyone's S.O.S.'

See also:

Trojan poses as war death notice

Iraq becomes the latest social engineering trick  05 Aug 2005

Cyber-criminals turn to extortion and fraud

Large-scale security attacks on the increase  03 Aug 2005

Hackers move into information kidnap

Pay up or you'll never see your data again  25 May 2005

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!