Porn virus publishes web history of victims on the net - GoFuckYourself.com

DVTimes · 04-15-2010, 10:19 AM

A new type of malware infects PCs using file-share sites and publishes the user's net history on a public website before demanding a fee for its removal.

The Japanese trojan virus installs itself on computers using a popular file-share service called Winni, used by up to 200m people.

It targets those downloading illegal copies of games in the Hentai genre, an explicit form of anime.

Website Yomiuri claims that 5500 people have so far admitted to being infected.

The virus, known as Kenzero, is being monitored by web security firm Trend Micro in Japan.

Masquerading as a game installation screen, it requests the PC owner's personal details.

It then takes screengrabs of the user's web history and publishes it online in their name, before sending an e-mail or pop-up screen demanding a credit card payment of 1500 yen (£10) to "settle your violation of copyright law" and remove the webpage.

Held to ransom

The website that the history is published on is owned by a shell company called Romancing Inc. It is registered to a fictitious individual called Shoen Overns.

"We've seen the name before in association with the Zeus and Koobface trojans. It is an established criminal gang that is continuously involved in this sort of activity," said Rik Ferguson, senior security advisor at Trend Micro.

Kenzero is a twist on ransomware, he added, which infects a computer and encrypts the documents, pictures and music stored on it, before demanding a fee for a decryption key.

"Interestingly we've seen a separate incident that focuses on European victims," he said.

A fictitious organization calling itself the ICPP copyright foundation issues threatening pop-ups and letters after a virus searches the computer hard drive for illegal content - regardless of whether it actually finds anything.

It offers a "pretrial settlement" fine of $400 (£258) payable by credit card, and warns of costly court cases and even jail sentences if the victim ignores the notice.

However rather than take the money, the outfit sells on the credit card details, said Mr Ferguson.

"If you find you are getting pop-ups demanding payments to settle copyright infringement lawsuits, ignore them and use a free online anti-malware scanner immediately to check for malware," was his advice.

"And if there's online content that you want to get hold of, get it from a reputable website - if that means paying that's what you have to do."

http://news.bbc.co.uk/1/hi/technology/8622665.stm

TeenCat · 04-15-2010, 10:21 AM

good job ...

Phoenix · 04-15-2010, 10:22 AM

awesome...we need this for porn also

u-Bob · 04-15-2010, 10:32 AM

Quote:

Originally Posted by TeenCat

good job ...

Quote:

Originally Posted by Phoenix

awesome...we need this for porn also

Really?? All this will do is encourage surfers to remove their history, block cookies etc.... and affiliates will pay the price....

TeenCat · 04-15-2010, 10:53 AM

not sure about the damage, but something like popup saying "porn is not free" for porn thiefs will be a nice one ... good job is that someone has done it

tonyparra · 04-15-2010, 11:39 AM

congrats

04-15-2010, 10:19 AM	#1
DVTimes xxx Industry Role: Join Date: Jun 2003 Location: UK Posts: 31,544	Porn virus publishes web history of victims on the net A new type of malware infects PCs using file-share sites and publishes the user's net history on a public website before demanding a fee for its removal. The Japanese trojan virus installs itself on computers using a popular file-share service called Winni, used by up to 200m people. It targets those downloading illegal copies of games in the Hentai genre, an explicit form of anime. Website Yomiuri claims that 5500 people have so far admitted to being infected. The virus, known as Kenzero, is being monitored by web security firm Trend Micro in Japan. Masquerading as a game installation screen, it requests the PC owner's personal details. It then takes screengrabs of the user's web history and publishes it online in their name, before sending an e-mail or pop-up screen demanding a credit card payment of 1500 yen (£10) to "settle your violation of copyright law" and remove the webpage. Held to ransom The website that the history is published on is owned by a shell company called Romancing Inc. It is registered to a fictitious individual called Shoen Overns. "We've seen the name before in association with the Zeus and Koobface trojans. It is an established criminal gang that is continuously involved in this sort of activity," said Rik Ferguson, senior security advisor at Trend Micro. Kenzero is a twist on ransomware, he added, which infects a computer and encrypts the documents, pictures and music stored on it, before demanding a fee for a decryption key. "Interestingly we've seen a separate incident that focuses on European victims," he said. A fictitious organization calling itself the ICPP copyright foundation issues threatening pop-ups and letters after a virus searches the computer hard drive for illegal content - regardless of whether it actually finds anything. It offers a "pretrial settlement" fine of $400 (£258) payable by credit card, and warns of costly court cases and even jail sentences if the victim ignores the notice. However rather than take the money, the outfit sells on the credit card details, said Mr Ferguson. "If you find you are getting pop-ups demanding payments to settle copyright infringement lawsuits, ignore them and use a free online anti-malware scanner immediately to check for malware," was his advice. "And if there's online content that you want to get hold of, get it from a reputable website - if that means paying that's what you have to do." http://news.bbc.co.uk/1/hi/technology/8622665.stm __________________ The Affiliate Program

04-15-2010, 10:21 AM	#2
TeenCat Too lazy to set a koala Industry Role: Join Date: Jan 2007 Location: CZ/EU forever! Posts: 16,139	good job ... __________________ 6bot / Coming again very soon! Svit Zlin Radio 24/7!

04-15-2010, 10:22 AM	#3
Phoenix BACON BACON BACON Industry Role: Join Date: Nov 2002 Location: Poems everybody, the laddie fancies himself a poet Posts: 35,457	awesome...we need this for porn also __________________ Skype Phoenixskype1 Telegram PhoenixBrad https://quantads.io

04-15-2010, 10:53 AM	#5
TeenCat Too lazy to set a koala Industry Role: Join Date: Jan 2007 Location: CZ/EU forever! Posts: 16,139	not sure about the damage, but something like popup saying "porn is not free" for porn thiefs will be a nice one ... good job is that someone has done it __________________ 6bot / Coming again very soon! Svit Zlin Radio 24/7!

04-15-2010, 11:39 AM	#6
tonyparra Confirmed User Industry Role: Join Date: Jul 2008 Location: In your back seat with duck tape Posts: 4,568	congrats __________________ High Performance Vps $10 Linode Manage your Digital Ocean, Linode, or Favorite Cloud Server. Simple, fast, and secure Server Pilot