There's a new ransomware making the rounds called Locky. Like Cryptolocker and other ransoms, this virus encrypts your files (RSA 2048 bit) and forces you to pay a fee (usually 0.5 BTC) to unlock them with a custom decryption program. This virus differs from other ransoms in that it uses spam emails (Invoice emails) to trick the user into opening a word document; that word document will contain scrambled text prompting the user to enable macros; once macros are enabled, the virus downloads the payload from the command and control server and then encrypts your files within a matter of hours. Currently, there is no way to decrypt the files aside from paying the ransom WHICH YOU SHOULDN'T DO!

 

How to protect yourself:

 

- Make sure your antivirus definitions are up to date 

- Don't enable macros on word

- Don't open the spam emails containing the infected word documents 

- BACKUP YOUR SYSTEMS. I cannot stress this enough. Locky removes shadow copies so trying to get the files back with a program like shadowexplorer is not guaranteed

 

 

Malewarebytes article source: https://blog.malwarebytes.org/threat-analysis/2016/03/look-into-locky/

Thanks for this info: I literally got an email like you're describing today. 

Interesting. I just got an Xbox Live invoice that contains a Word document called "noname.txt."

Good thing I didn't open it, regardless of whether or not it actually contains the Locky malware.

 

EDIT: lol, can't even believe I said that. .txt isn't even a Word document.

 

go to sleep, rocketboy, it's 2 am

Edited April 5, 201610 yr by Rocketboy227

Happened to me once many years ago. I freaked out for a hot second because Comcast (the real Comcast) had just emailed me saying they suspected my computer of being part of a bot net, which given that this thing activated later one, it probably was.

 

There's a few solutions, backups being one of them. You can also download a cleaner program, save it on a USB, then sideload it from the command menu if your computer does end up being locked, which is what I did last time.