[Peaches]

Vundo malware now encrypts users' files and then charges a fee to decrypt them
Mar 25, 2009 | 05:10 PM

By Tim Wilson
DarkReading
Researchers at security vendor FireEye have discovered that malware formerly used to push "scareware" is now being used to push "ransomware."

According to a

"Vundo has fundamentally altered its criminal business model from 'scareware' tactics to 'ransomware' extortion," blogs Alex Lanstein of FireEye's Malware Intelligence Lab. "While a user may be 'silly' to buy into scareware, they have little choice but to purchase the decryption software once the ransomware does its thing."

FireEye describes Vundo as a "generic Trojan" that sends a popup to Web users. In this case, however, Vundo is "pushing a piece of malware that encrypts various personal file types (.pdf, .doc, .jpg, etc.) on your system, and 'coincidentally' pushes a program called FileFix Pro 2009, which would decrypt them -- for a fee."

After studying the malware, FireEye developed a Perl script that will decrypt the files minus a fee. Users can upload their infected files to the the FileFix File Decrypter and receive back readable files. "In the coming days we'll be releasing a tool you can download that will decrypt all the affected files on your system," Lanstein blogs.

So far, none of the antivirus tools tested have been able to detect or eradicate the Vundo-borne malware because it is "polymorphic" and appears as a different executable file each time, FireEye says.

DarkReading - http://www.darkreading.com/security/attack...ttacks/breaches

[Peaches]

Good links to the Symantec Info and tools to clean and decrypt

https://forums2.symantec.com/t5/blogs/bloga.../article-id/255

http://www.symantec....-032402-1233-99

http://www.symantec.com/content/en/us/glob.../FixXrupter.exe