Internet threat level: 1
Home→Descriptions→Trojan-Ransom.Win32.Cryzip.a
Trojan-Ransom.Win32.Cryzip.a
| Detected | Mar 22 2006 21:19 GMT |
| Released | Mar 22 2006 22:41 GMT |
| Published | Mar 17 2006 14:36 GMT |
Removal instructions
Technical Details
This Trojan encrypts user files on the victim machine. It is a Windows file 1191936 bytes in size.
The Trojan itself is a DLL library which injects itself into all applications which are launched on the victim machine.
Once launched, the Trojan archives files with the extensions listed below:
arh asm arj bas cdr cgi chm cpp db db1 db2 dbf dbt dbx doc dpr dsw frm frt frx gtd gz gzip jpg key kwm lst man mdb mmf mo old p12 pas pak pdf pgp pl pwl pwm rar rtf safe tar txt xls xml zip
The Trojan does not archive files which are located in folders with the following names:
System System32
The files are archived in a password protected ZIP file. The following string is used as the password:
C:\Program Files\Microsoft Visual Studio\VC98
Archived files will have the following name:
<original file name>_CRYPT_.zip
The encrypted files can then not be used. The remote malicious user attempts to extort money from the victim.
The Trojan creates a file named AUTO_ZIP_REPORT.txt in folders which contain archived files. AUTO_ZIP_REPORT contains the following text:
OUR E-GOLD ACCOUNT: *******
INSTRUCTIONS HOW TO GET YUOR FILES BACK
READ CAREFULLY. IF YOU DO NOT UNDERSTAND, READ AGAIN.
This is automated report generated by auto archiving software.
Your computer catched our software while browsing illigal porn
pages, all your documents, text files, databases was archived
with long enought password.
You can not guess the password for your archived files - password
lenght is more then 10 symbols that makes all password recovery
programs fail to bruteforce it (guess password by trying all
possible combinations).
Do not try to search for a program what encrypted your information - it
is simply do not exists in your hard disk anymore.
If you really care about documents and information in encrypted files
you can pay using electonic currency $300.
Reporting to police about a case will not help you, they do not know
password. Reporting somewhere about our e-gold account will not help
you to restore files. This is your only way to get yours files back.
------------------------------
How to pay to get your information back.
1. click on this link to open your free e-gold account - the first
screen is the e-gold "terms and conditions" page. You need to
agree to these by clicking on the "I AGREE" button on the bottom
on the page.
2. On the next page is the sign up form:
1. "Account name" - here is where you name your account - tip:
make it easy to remember (as you will be asked for it) and
reasonably short, example, "John's e-gold", "My Money e-gold"
or perhaps "Felix" (whatever you like, just make it easy for
you to remember it).
2. "User Name" - here just repeat the account name (from 1 above).
3. "Point of Contact" - this is where you put our name, address,
phone number and email address (any email address can be used
here but it is recommended you use your ISP address - not a
free hotmail, etc address).
It is also recommended your also include a fax number
(don't have a fax number? This company offers free fax to email
services). Try and make it as easy as possible for e-gold to contact you.
4. "Passphrase" - this is the most important piece of information
connected to any e-gold account. We can not stress enough how
important it is that your passphrase is kept safe and secure.
5. "Turing Number Entry" - type the 6 numbers you see there into the input
box below.
6. The last step click "Open"
On the next page it will tell you that your e-gold account number has been emailed to you.
check your email - you can expect to wait up to 5 minutes for your account number
to arrive. If it does not arrive after 5 minutes then that means the email address
you supplied was incorrect and you will have to open another new account (go through
and repeat what you just did above again).
To buy e-gold to your account please use official exchange services
http://www.me-gold.com/
http://www.goldex.net/
http://usece.com/
or try to search own way with
http://gold-pages.net/e-Gold__1MDC__Pecunix_Wizard_Links/Purchase_E-gold/index.html
http://www.google.com/search?hl=en&q=buy+e-gold&btnG=Google+Search
FINALLY when you bought e-gold you have to transfer $300 to our e-gold account.
In next 24 hours you will recieve $1 back to your account. Transfer details
of this $1 transfer will have a link to software that will automatically
unzip all your files back to normal state.
Next day login to your account https://www.e-gold.com/acct/login.html,
press History and press submit, you will see LINK TO UNZIP-software.
#####################################################
Remember you are just $300 away from your files
#######################################################
Users are warned to be careful when downloading or using files downloaded from the Internet, or of unknown origin.
Additionally, users should not send money to remote users; this will act as a stimulus to create new versions of malicious programs.
Removal instructions
- Perform a full scan of your computer (download trial version).
- Unzip the files corrupted by the Trojan using a standard program. Use the following password:
C:\Program Files\Microsoft Visual Studio\VC98
This type of Trojan modifies data on the victim computer so that the victim can no longer use the data, or it prevents the computer from running correctly. Once the data has been “taken hostage" (blocked or encrypted), the user will receive a ransom demand.
The ransom demand tells the victim to send the malicious user money; on receipt of this, the cyber criminal will send a program to the victim to restore the data or restore the computer’s performance.
Trojan-Ransom.
- Trojan.
Win32. Cryzip. a (Kaspersky Lab) - Virus.
Win32. Zippo. 10 (Kaspersky Lab) - Trojan:
CryZip (McAfee) - Troj/CryZip-A (Sophos)
- W32/Zappo.
A@dr (FPROT) - Trojan:
Win32/Agent (MS(OneCare)) - Trojan.
Cryzip (DrWeb) - Win32/Cryzip.
A trojan (Nod32) - Dropped:
Win32. Zippo. 10 (BitDef7) - Trojan.
DR. Zappo. A (VirusBuster) - Win32:
Trojan-gen {Other} (AVAST) - Trojan-Ransom (Ikarus)
- Generic.
RSH (AVG) - TR/Drop.
Kerrab (AVIRA) - Trojan Horse (NAV)
- W32/Cryzip.
A (Norman) - Trojan.
Agent. ayv (Rising) - TROJ_CRYZIP.
A (TrendMicro)
© 1997-2010 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.