Security specialists are warning of a new virus that encrypts data on
infected machines and demands money for the decryption key.
'Gpcode' is thought to access PCs via unpatched browsers. Once active it
encodes most of the data on the computer, including .doc, .txt, .pdf, .xls, .jpg
and .png files, with a 1,024-bit key.
Advertisement
Once all the files have been encrypted a ReadMe file is left on the machine
giving an email address to send money in order to get the decryption key.
The malware is a revision of a
previous
virus, thought to be from the same author, which appeared two years ago but
only used a 660-bit key.
"Virus researchers have been able to crack keys up to 660 bits," said Timur
Tsoriev of Kaspersky Labs.
"This was the result of a detailed analysis of the RSA algorithm
implementation. If the encryption algorithm is implemented correctly, it could
take one PC with a 2.2GHz processor around 30 years to crack a 660-bit key."
We urge infected users not to yield to the blackmailer
Timur Tsoriev Kaspersky Labs
The company has urged users struck by the virus not to reboot or shut down
the infected machine.
Instead they should get in contact immediately with the last few websites
they visited to determine what, if any, programs were running.
"We urge infected users not to yield to the blackmailer, but to contact us
and your local cyber-crime law enforcement units," said Tsoriev. "Yielding to
blackmailers only continues the cycle."
Do you agree?
Have your say on this article