Trojan demands money for internet access

There's nothing new about Windows trojans resorting to a little blackmail, but Computer Associates has now observed a new twist; a trojan which blocks internet access until the user enters an activation code. This is activation code is obtained by sending an SMS containing a particular number to an expensive premium rate phone number – CA does not mention the sum involved.

The malware, dubbed 'Win32/RansomSMS.AH', infects computers by claiming to be the "uFast Download Manager" tool which, when run, accuses users (in Russian) of having breached their licence conditions. CA has kindly provided a free tool (via zip direct download) to enable users to generate the required code for themselves.

Previous examples of ransomware have been known to lock users out of Windows or to encrypt files using a supposedly unbreakable algorithm.

See also:

• From scareware to ransomware, a report from The H Security.
  
• This Trojan encrypts data with RSA-4096 -- really?, a report from The H Security.

(djwm)