Mahatma Gandhi once said, “There is sufficiency in the world for man’s need but not for man’s greed.”Even in today’s times, these words are so true, especially when it concerns a criminal!
Are you a video gamer, who plays games such as Call of Duty,Star Craft 2, Fallout 3 on frequent basis?If yes, then you surely need to read this.Even if you don’t, you still need to know this.
According to a new research, a new file encrypting program has been discovered, which is used by hackers to extort money from users called TelsaCrypt Ransomware, which is the new version of Ransomware.
According to US-CERT, Ransomware is a type of malware that infects a computer and restricts a user’s access to the infected computer. This type of malware, which has now been observed for several years, attempts to extort money from victims by displaying an on-screen alert. These alerts often state that their computer has been locked or that all of their files have been encrypted, and demand that a ransom is paid to restore access. This ransom is typically in the range of $100–$300 dollars and is sometimes demanded in virtual currency, such as Bitcoin.
What is TelsaCrypt Ransomware?
A variant of CryptoLocker Ransomware which can prohibit users accessing their photos, personal documents and most importantly game files, making it unique when in comparison with Cryptolocker Ransomware. It is also called as Cryptolocker- v3, which will encrypt files present in user system. The private key is owned by the hacker and the victim has to pay a ransom demanded by the cyber-criminal to regain the access.
How does TelsaCrypt Ransomware work?
It typically propagates as a spam email attachment or as a Trojan that enters system bundled with a freeware or a downloaded file from Internet. Once entered the user’s system, it starts the process of encryption, i.e. encrypting document files, photos and gaming files present in hard drive.
Cryptolocker-v3 uses AES encryption, which encrypts following extensions: .xlsm, .syncdb, .pptm, .doc and .mdbackup files. To every extension which is encrypted extension, .Ecc is added. When the encryption of files is complete, all Shadow Volume Copies and restore points are deleted from victim’s system. This is to ensure that the victim is unable to restore data from System Restore Points.
After successful deletion of Shadow Volume Copy and restore points, victim’s desktop wallpaper is changed to a ransom note along with a text file that consists of instructions how victim can recover their encrypted files.
Researchers have also found that TelsaCrypt Ransomware might kill processes related to System Configuration (msconfig), Command Prompt (cmd.exe), Task Manager (taskmgr.exe), Registry Editor (regedit.exe) and Process Explorer (procexp.exe) which may make it difficult for user to remove the Ransomware. This type of Ransomware accepts Bitcoins as ransom payment and but also accepts ‘Paypal My Cash Cards’ making it a peculiar of its kind.
So how can we safeguard ourselves against TelsaCrypt Ransomware? Below are some tips suggested for same:
- Update your antivirus software (eScan) on regular basis, which will protect your system from all kinds of Malware attacks.
- Ensure that all software’s installed in your system are updated frequently, including Oracle Java and Adobe.
- Avoid clicking pop-ups, especially displayed on an unknown website as it may lead to unintentional download of a Virus or Malware onto your system.
- Never send or reply to emails which ask for sensitive information such as Credit card number, PIN (Personal Identification Numbers) and Bank account number to an unauthorized person.
- Disable Auto-play of USB and Optical drives such as Pen drive, External Hard Disk and CD/DVD.
- Make sure that pop-up blocker is running in your web browser.
- Regularly backup your important files.
