• Total Posts: 28018
  • Total Topics: 8050
  • Online Today: 802
  • Online Ever: 51419
  • (01. January 2010., 09:27:49)

Author Topic: Wave of Ransom Malware Hit Internet (Security Tool,, HTML/Goldun.AXT)  (Read 2311 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7151
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum

Criminals reused an attack from 2008 to hit the Internet with a huge wave of ransomware in recent weeks, a security company has reported.

In the space of only two days, February 8 and 9, the HTML/Goldun.AXT campaign detected by Fortinet accounted for more than half the total malware detected for February, which gives some indication of its unusual scale:

The attack itself takes the form of a spam e-mail with an attachment,, which if clicked automatically downloads a rogue antivirus product called Security Tool. It is also being distributed using manipulated search engine optimisation (SEO) on Google and other providers.

Such scams have been common on the Internet for more than a year, but this particular one features a more recently-evolved sting in the tail. The product doesn't just ask the infected user to buy a useless license in the mode of scareware, it locks applications and data on the PC, offering access only when a payment has been made through the single functioning application left, Internet Explorer.

What's new, then, is that old-style scareware has turned into a default ransom-oriented approach. The former assumes that users won't know they are being scammed, while the latter assumes they will but won't know what to do about it.

The technique is slowly becoming more common -- see the Vundo attack of a year ago -- but what is also different is the size of this attack, one of the largest ever seen by Fortinet for a single malware campaign.

Fortinet notes that Security Tool is really a reheat of an old campaign from November 2008, which pushed the notorious rogue antivirus product Total Security as a way of infecting users with a keylogging Trojan.

"This is a great example of how tried and true attack techniques/social engineering can be recycled into future attacks," says Fortinet's analysis.

According to Fortinet, the "engine" pushing the spike in ransom-based malware is believed to be the highly-resilient Cutwail/Pushdo botnet, the same spam and DDoS system behind a number of campaigns in the last three years including the recent pestering of PayPal and Twitter sites.


Samker's Computer Forum -


  • SCF Advanced Member
  • ***
  • Posts: 163
  • KARMA: 21
I think i can get some with this xit!!Most of people never will get learning about computer.Malwarebytes ou SuperAntispye does a good job removing most of the recent malware.


  • SCF Member
  • **
  • Posts: 26
  • KARMA: 1
thx you It's not good


  • SCF Member
  • **
  • Posts: 28
  • KARMA: 0
do use malwarebytes antimalware to clean stubborn rogue antivirus software


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising