Vicrypt malware holds hard drives for ransom

by billso on Tuesday, 3 November 2009

Here’s a new twist on an old malware tactic, in which a victim’s files are encrypted and more or less held for ransom. The malware usually pops up a helpful note or displays a web page that offers software to “fix” the problem.

According to an article in CNET called New Trojan encrypts files but leaves no ransom note, Symantec has identified a Trojan that the company calls Trojan.Ramvicrype. This malware encrypts files on Windows machines, leaving behind directories full of files with .vicrypt extensions. Windows soon begins displaying error messages because the Trojan has encrypted system files as well.

It’s up to the user to do a web search for vicrypt help — a search that may return a web site that sells software to unencrypt vicrypt files.

Of course, that software is probably loaded with more malware — and the victims are paying for it. PC World and Technologizer reported today that malware makers are organized, sophisticated — and targeting users who aren’t running antivirus or security software.

Symantec has developed and posted its own free tool to remove the infection and decrypt the files — it’s available at Trojan.Ramvicrype Removal Tool.

Updated on 4 November 2009: In a Facebook comment about this article, Dale Chun suggested two freemium products that can detect and remove similar malware infections: Malwarebytes or Prevx. These products can handle multiple types of malware, while Symantec’s free removal tool is more specific.

Image by RobertBasil on Flickr via a Creative Commons license.