There's a whole bunch of variants of this - I keep seeing "Internet Antivirus Pro" popping up. ---- Jack Kramer Computer Systems Specialist University Relations, Michigan State University w: 517-884-1231 / c: 248-635-4955 ________________________________ From: l duynslager <[log in to unmask]> Reply-To: l duynslager <[log in to unmask]> Date: Mon, 30 Mar 2009 10:02:41 -0400 To: <[log in to unmask]> Subject: [MSUNAG] Antivirus2009 Excerpted From SANS NewsBites Vol. 11 Num. 24: --Ransomware Scheme Incorporates Phony Antivirus Program (March 25, 2009) A sophisticated form of ransomware is spreading on the Internet. Users are tricked into downloading malware that appears to be a legitimate utility called Antivirus2009. The malware actually encrypts numerous document types. When the user tries to open one of the encrypted files, an alert pops up, offering a utility, FileFix Pro 2009, that can decrypt the file. The application decrypts one document, then demands that the user pay US $50 to buy the software to decrypt the rest. http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9130539&source=rss_topic17 http://www.theregister.co.uk/2009/03/25/scareware_ransomware/ http://www.zdnetasia.com/news/security/0,39044215,62052554,00.htm