Trojan.Winlock Virus Extorts Millions from Russians in One Month

Russian Internet surfers have been suffering from numerous attacks from Trojan.Winlock viruses recently. The worm penetrates into a computer, blocks the system and asks for money.
The screen shows “Windows is blocked” message. A person has to send an SMS to the indicated number to unlock the system. The price for the message is quite high: not less than 300 rubles ($10). If the message is sent, it comes back to the victim’s cell phone with a code to unlock the system.

However, the story repeats again several days later. The worm does not get deleted from the system after the first payment is done and hampers the work of anti-virus programs,
Askar Tuganbayev, an internet expert, said that dishonest suppliers of content for cellular phones began to use their registered short numbers for online fraud.

“It is very easy to track down those companies. They have contractual obligations with cellular network operators. The two sides receive profit from that, so they prefer to turn a blind eye on the problem,” he said.

Several millions of Russians have already suffered from the attacks of Trojan.Winlock virus in January of this year, Dr. Web anti-virus company said.

First modifications of the virus appeared about three years ago, but they did not pose any significant threat. They would be automatically removed from infected computers in several hours, and the price for the text message was much lower.

New modifications became a lot more dangerous. Trojan.Winlock infects computers through various holes in Windows, particularly through Internet Explorer, downloaded codecs, iframe exploits and botnets.

The current price of a text message ($10-20), which a victim sends to unlock their Windows, means that fraudsters have received the profit of hundreds of millions of rubles.