Nuevo malware que cifra los ficheros sin pedir rescate: Ransom-NThreat Search segun Mcafee, alias Trojan.Ramvicrype

Nuevo malware que cifra los ficheros sin pedir rescate:  Ransom-NThreat Search segun Mcafee, alias Trojan.Ramvicrype

Virus Profile: Ransom-NThreat Search
     

Risk Assessment: Home Low-Profiled
Corporate Low-Profiled
Date Discovered: 11/3/2009  (3 de Noviembre)
Date Added: 11/3/2009       (3 de Noviembre)
Origin: N/A                 (se supone Mauritania)
Length: Varies
Type: Trojan
Subtype: Trojan
DAT Required: 5792
Removal Instructions

  OverviewVirus CharacteristicsRemoval Instructions 
 
Description
— Update November 3, 2009 —
The risk assessment of this threat has been updated to Low-Profiled due to media attention
 at:
http://www.theregister.co.uk/2009/11/03/ransomware_ruse/

—
Ransom-N is a Trojan that on execution encrypts all the recently used files on the user’s
 system.The user has to pay for the attackers’ software to decrypt and recover their files
.

Indication of Infection
Presence of files with the “.vicrypt” extension on the user’s system.
Methods of Infection
Trojans are not viruses, and as such do not contain any method to replicate by themselves.
 However they may be downloaded by other viruses and/or Trojans to be installed on the user’s system.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link,
 or by the website hosting a scripted exploit which installs the malwares).
Aliases
Trojan.Ramvicrype

Aparte de la detección con el antivirus, la presencia de ficheros con extension .vicrypt en la carpeta de sistema

Existe la empresa Ezquisys Software Technology, con sede en Mauritania, que ofrece un producto llamado Antivicrypt que soluciona el problema de los archivos “dañados”.

En el caso de que fuera detectado, enviennos muestra de estos ficheros extension .vicrypt y procederíamos en consecuencia

saludos

ms, 5-11-2009