Internet threat level: 1
Home→Descriptions→Trojan-Ransom.Win32.Gpcode.ac
Trojan-Ransom.Win32.Gpcode.ac
| Detected | Jan 30 2006 13:50 GMT |
| Released | Jun 26 2006 08:43 GMT |
| Published | Jan 30 2006 13:50 GMT |
Removal instructions
Technical Details
This file virus is a Windows PE EXE file, packed using UPX. The packed file is approximately 61KB in size, and the unpacked file is approximately 134KB in size.
The program was widely distributed throughout the Russian segment of the Internet using spammer technologies.
Once launched, the virus encrypts files saved on the victim machine which have the following extensions:
arh arj c cdr cgi chm cnt cpp css csv db db1 db2 dbf dbt dbx doc flb frm frt frx gtd gz gzip h htm html key kwm lst man mdb mmf mo old p12 pak pdf pem pfx pgp pl prf prx pst pwa pwl pwm rar rmr rnd rtf safe sar sig tar tbb txt xls xml zip
The virus partly uses the RSA algorithm to encrypt files.
Once encrypted, files cannot be used. The author of the program then demands money to decrypt the encrypted files. A file called 'readme.txt' appears in folders where encrypted files are located. The file contains the following text (although the email and the encryption key may differ):
Some files are coded by RSA method. To buy decoder mail: *****sh34@rambler.ru with subject: RSA 5 ********728578411
When contacted by the user, the author of the program will demand payment for decrypting the encrypted files.
Users are reminded that they should be extremely cautious when faced with attachments to suspicious messages. Additionally, users should not contact the authors of malicious programs, nor pay them money, as this will simply act as motivation to write new variants.
Removal instructions
- Conduct a full scan of your computer using an updated version of Kaspersky Anti-Virus(download a trial version).
- If the antivirus is unable to decrypt the infected file, please send the infected file to newvirus@kaspersky.com (our virus laboratory) for analysis.
This type of Trojan modifies data on the victim computer so that the victim can no longer use the data, or it prevents the computer from running correctly. Once the data has been “taken hostage" (blocked or encrypted), the user will receive a ransom demand.
The ransom demand tells the victim to send the malicious user money; on receipt of this, the cyber criminal will send a program to the victim to restore the data or restore the computer’s performance.
Trojan-Ransom.
- Virus.
Win32. Gpcode. ac (Kaspersky Lab) - Virus.
Win32. Gpcode. av (Kaspersky Lab) - Trojan.
Encoder (DrWeb) - Trojan.
Encoder. BA (BitDef7) - Trojan.
Encoder. AI (BitDef7) - Trojan.
Encoder. BQ (BitDef7) - Trojan.
Encoder. AG (BitDef7) - Trojan.
Encoder. BK (BitDef7) - Trojan.
Encoder. E (BitDef7) - Trojan.
Encoder. BG (BitDef7) - Trojan.
Encoder. AH (BitDef7) - Trojan-Ransom.
Win32. Gpcode (Ikarus) - Trojan.
Gpcoder (NAV) - Suspicious_Gen2.
DQMFZ (Norman) - Suspicious_Gen2.
DQKYU (Norman) - Suspicious_Gen2.
DQKXG (Norman) - Suspicious_Gen2.
DQNMW (Norman) - Suspicious_Gen2.
DQNTS (Norman) - Suspicious_Gen2.
DQMGF (Norman) - Suspicious_Gen2.
DQLOL (Norman) - Suspicious_Gen2.
DQNVR (Norman) - Trojan-Ransom.
Win32. Gpcode. ac [AVP] (FSecure)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.