Internet threat level: 1
Home→Descriptions→Trojan-Ransom.Win32.Gpcode.ad
Trojan-Ransom.Win32.Gpcode.ad
| Detected | May 22 2006 10:46 GMT |
| Released | May 22 2006 12:20 GMT |
| Published | Jun 09 2006 13:18 GMT |
Removal instructions
Technical Details
This malicious program encrypts files on the victim machine. It is a Windows PE EXE file 61 440 bytes in size, packed using UPX. The unpacked file is approximately 135KB in size.
Once launched, the virus encrypts files with the following extensions:
3ds 3dx acd ace ai arc arh arj c cdr cgi chm cnt cpp css csv db db1 db2 dbf dbt dbx dic doc dsc dwg dxf eps fax fla flb frm frt frx gtd gz gzip h ha htm html jar key kwm lst lzh ma man mar mdb mmf mo old p12 pak pdf pem pfx pgp pl ppt prf prx ps pst pwa pwl pwm rar rle rmr rnd rtf safe sar sig sln swf tar tbb tex tga txt xcr xls xml zip zoo
The virus partially uses the RSA 67 bit algorithm to encrypt files.
Files encrypted by the virus cannot be used. The malicious user will then demand money for decrypting the files.
The virus creates a file called ‘readme.txt’ in folders which contain encrypted files. 'Readme.txt' contains the following message:
The email address used may differ from variant to variant.
If the user makes contact via the email address in the message, s/he will be asked to pay a certain sum in return for the encrypted files being decrypted.
Kaspersky Lab reminds Internet users to be extremely cautious with potentially suspicious messages from unknown users and with files from unknown sources.
In addition to this, no money should be paid, as this will motivate the authors of this malicious program to create new variants.
Once the virus has encrypted files, it creates a file called TMP.BAT. This file contains code which will delete the source code of the malicious program.
Removal instructions
- Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).
- If your files remain encrypted after scanning with Kaspersky Anti-Virus, please send a sample file to our Virus Lab (newvirus@kaspersky.com).
This type of Trojan modifies data on the victim computer so that the victim can no longer use the data, or it prevents the computer from running correctly. Once the data has been “taken hostage" (blocked or encrypted), the user will receive a ransom demand.
The ransom demand tells the victim to send the malicious user money; on receipt of this, the cyber criminal will send a program to the victim to restore the data or restore the computer’s performance.
Trojan-Ransom.
- Virus.
Win32. Gpcode. ad (Kaspersky Lab) - Trojan:
GPcoder (McAfee) - Mal/Generic-A (Sophos)
- Trojan.
Gpcode-2 (ClamAV) - Trojan.
Encoder. origin (DrWeb) - Win32/Gpcode trojan (Nod32)
- Trojan.
Generic. 3168476 (BitDef7) - Virus.
Win32. Gpcode (Ikarus) - Win32/Gpcode.
D (AVG) - TR/Crypt.
XPACK. Gen (AVIRA) - Trojan.
Gpcoder (NAV) - Harm.
Gpcode. c (Rising) - Trojan-Ransom.
Win32. Gpcode. ad [AVP] (FSecure) - Trojan.
Win32. Generic!BT (Sunbelt)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.