WTF! New Trojan blocking Windows!
Just a few hours ago I talked with a friend in ICQ (both via qip). We are talking about photoapprata, mirrors VS. soap dishes, and so on. And then an unexpected message comes from him like “Do you think this photo was taken with the help of Photoshop and the link ...” to the file with the * .scr extension, ie the screensaver, well, I think we need to open it, a reliable friend will not send the bad one, open it and voila - at first glance the usual Trojan lock system, about which already wrote. But no, there is a blue screen of death, stupid, supposedly system inscriptions + text SEND SMS with text oldPROBELoper to such a number and so on, an input window and a button. Focus automatically translates to the window. None of the key combinations work (even such as Win + U, 8 seconds of shift).
Rebooting does not help, respectively, the key generator from Dr.Web also refuses, because there is only text in the form of a message. The inputs “0” and the words “credited” also do not work.
Booted only in debug mode, looked at the registry load, autoload, searched antivirus, search - nothing!
I restart the computer again the same screen. Again I climb under the "debug". Now a few more messages come from the same text, plus it turns out that this is the same thing from me. Although ICQ could not be hacked, it was too heavy a password for me, which is unrealistic to pick up. And yet - in the history of messages, there is not a single mention of this, neither I have the lists of my contacts.
And yet, this client obviously emulated the input, as it came from the first friend, then from me, and so on, who had qvip - nothing was left in the stories on both sides, who had a different client, then there are more stories the chain did not go.
What kind of beast and how to fight it have not yet found, who knows what - unsubscribe.
I allegedly sent such a “noticeable that the photo in Photoshop is edited or not?
BBB (replaced) .hochubilet.net / foto334.gif "Although the first file that was sent to me was with the extension * .scr
PS Only do not send SMS, so we solve the problem!
UPD Published a blog - information security.
Rebooting does not help, respectively, the key generator from Dr.Web also refuses, because there is only text in the form of a message. The inputs “0” and the words “credited” also do not work.
Booted only in debug mode, looked at the registry load, autoload, searched antivirus, search - nothing!
I restart the computer again the same screen. Again I climb under the "debug". Now a few more messages come from the same text, plus it turns out that this is the same thing from me. Although ICQ could not be hacked, it was too heavy a password for me, which is unrealistic to pick up. And yet - in the history of messages, there is not a single mention of this, neither I have the lists of my contacts.
And yet, this client obviously emulated the input, as it came from the first friend, then from me, and so on, who had qvip - nothing was left in the stories on both sides, who had a different client, then there are more stories the chain did not go.
What kind of beast and how to fight it have not yet found, who knows what - unsubscribe.
I allegedly sent such a “noticeable that the photo in Photoshop is edited or not?
BBB (replaced) .hochubilet.net / foto334.gif "Although the first file that was sent to me was with the extension * .scr
PS Only do not send SMS, so we solve the problem!
UPD Published a blog - information security.
')
Source: https://habr.com/ru/post/59134/
All Articles