Kaspersky Lab warns users about two highly dangerous new ransomware programs sweeping across the Internet that could potentially wipe data from victims’ computers.<\/p>\n
One of the malicious programs is a new variant of the GpCode Trojan. According to Kaspersky it targets files with a wide variety of extensions, including doc, docx, txt, pdf, xls, jpg, mp3, zip, avi, mdb, rar, and psd, and encrypts them without the user’s authorisation.<\/p>\n
The corresponding Trojan-Ransom.Win32.GpCode.ax signature was added to Kaspersky Lab’s antivirus database on 29 November.<\/p>\n
Trojan-Ransom.Win32.GpCode.ax spreads via infected sites, exploiting vulnerabilities in Adobe Reader, Java, Quicktime Player, or Adobe Flash.<\/p>\n
Unlike previous versions of GpCode that date back to 2004, this Trojan doesn’t delete files after encrypting them, but instead overwrites data in the files making it impossible to use data-recovery software to restore the deleted data. The program uses the strong RSA-1024 and AES-256 crypto-algorithms.<\/p>\n
Kaspersky Lab says that they are analysing the new version of GpCode and investigating possible ways to restore data on affected machines.<\/p>\n
The second ransomware program detected by Kaspersky Lab earlier this week is a Trojan that infects the master boot record (MBR) of a compromised computer.<\/p>\n
Two signatures were added to the company’s antivirus databases: Trojan-Ransom.Win32.Seftad.a for the dropper and Trojan-Ransom.Boot.Seftad.a for instances when the MBR is infected.<\/p>\n
After infection, the malicious program overwrites the boot area before demanding that the computer’s owner makes a payment for a password that will restore the MBR. If an incorrect password is entered three times the infected computer reboots and the Trojan repeats its demand for money.<\/p>\n
Kaspersky recommends that users regularly update all the software installed on their computers in order to close any vulnerabilities.<\/p>\n