Ransom Trojan takes PC files hostage using unbreakable encryption

THE LATEST ransom Trojan malware uses 'unbreakable' forms of public key encryption to take your computer files hostage and extort money as ransom for them.

Ransom Trojans on your computer encrypt your files and ask for payment in different ways, sometimes with an overt threat to destroy the files if money isn't paid. In the past, computers could generally be unencrypted without people having to pay the ransom.

But Mikko Hypponen, chief security researcher at F-Secure, warned about the latest version of a ransom Trojan called GPcode. It uses public key encryption in the form of AES with an RSA key to lock the files on your computer. And instead of telling you to wire transfer money, it tells you to use prepaid credit cards, transferring the money that way.

He said, "We aren't aware of any mechanism of breaking that. If you have backups it's no problem. The next solution is to pay. And we know of people to have paid to get the key and information back."

Hypponen also spoke of another ransom Trojan that gives you an error message before Windows starts, saying it is locked, with a blue installation screen that gives you the impression that it is the work of Microsoft.

It says that activation is free and gives you the choice of doing it by Internet or by a phone call. Of course, you won't be given the option of an Internet activation on the next screen as it's "unavailable".

The phone numbers you are given claim to be international Microsoft installation numbers, but the author of the Trojan will make money from it by routing these expensive calls to cheaper countries, a technique called short stopping. µ