14 DAY TRIAL // Security researchers warn of a new piece of ransomware that spoofs the Windows license activation screen to trick users to call premium rate numbers.
Unlike scareware programs, which try to scare users into paying money for fixing fictitious computer problems, ransomware applications take a more aggressive approach and block access to critical features until payment is made.
A new piece of ransomware spotted by security experts from F-Secure is no different in that respect as it prevents victims from reaching their Desktop.
It displays a screen that looks like the Windows XP Activation one and claims that the Windows license needs activating.
"This copy of Windows is locked. You may be a victim of a fraud or there may be an internal system error. To continue using Windows you should complete activation," a message displayed on the rogue screen reads.
Users are told the process is absolutely free and they don't need to provide any personal information, claims that are obviously false.
Clicking "Next" on the first screen displays a new message claiming that SMS and Internet-based activation is not available and the only option is to call one of several toll-free phone numbers.
The numbers are registered in regions like São Tomé and Principe, Denmark or Madagascar. "The trojan claims that the call is 'free of charge' but it isn't, and the trojan author will earn money from the call via a technique known as short stopping.
"This method involves rogue phone operators who route the expensive calls to cheaper countries," explains F-Secure security advisor Sean Sullivan.
Fortunately, unlike other ransomware programs this is pretty easy to get rid of. The activation key given to people who call is always the same, 1351236, and can be used to unlock the computer, install a capable antivirus and remove the infection.
