A
new type of malware infects PCs using Japanese file-share sites and publishes
the user's net history on a public website before demanding a fee for its
removal.
The trojan installs itself on computers using a popular file-share
service called Winni, used by up to 200m people. It targets those
downloading copies of games in the Hentai genre, an explicit form of
anime.
The virus, known as Kenzero, is being monitored by web security firm
Trend Micro in Japan. Masquerading as a game installation screen, it
requests the PC owner's personal details.
It then takes screengrabs of the user's web history and publishes it
online in their name, before sending an e-mail or pop-up screen
demanding a credit card payment of 1500 yen (£10) to settle your
violation of copyright law and remove the webpage.
Website Yomiuri claims that 5500 people have so far fallen victim.
Rik Ferguson, senior security advisor at Trend Micro said
Interestingly we've seen a separate incident that focuses on European
victims, he said.
A fictitious organization calling itself the ICPP copyright
foundation issues threatening pop-ups and letters after a virus searches
the computer hard drive for illegal content - regardless of whether it
actually finds anything.
It offers a pretrial settlement fine of $400 (£258) payable by
credit card, and warns of costly court cases and even jail sentences if
the victim ignores the notice. However rather than take the money, the
outfit sells on the credit card details, said Ferguson.
If you find you are getting pop-ups demanding payments to settle
copyright infringement lawsuits, ignore them and use a free online anti-malware
scanner immediately to check for malware, was his advice.
Update:
Apprehended
29th May 2010. See article
from tgdaily.com
Japanese police have arrested two individuals accused of spreading a
nefarious piece of malware that stole personal information and posted it
on the Internet.
The malware was reportedly spread via the Winny peer-to-peer
file-sharing network posing as an adult-themed Hentai game. Upon
installing the program, victims were asked to enter their name, date of
birth, contact details and other personal information
At the same time, information such as browser bookmarks were being
stolen from the users' computer. At this point afflicted users probably
didn't realise anything untoward has occurred. They later they received
an email, asking for a fee to be paid to have the information removed.
Over 5,000 PCs had been targeted by the two extortionists.
An
ISP offering web filtering that uses BBFC classification certificates has
launched.
