Beware of Ransomware disguised as Windows 10 Update

If you dare to update your system to Windows 10 based on fake e-mails from Microsoft, then you could be a victim of Cryptolocker Ransomware. The eScan research team has discovered that cyber-criminals are using various social engineering techniques to take advantage of millions of people looking for a free system upgrade to Windows 10, which was officially launched on 29 July worldwide.

What is Cryptolocker?

It is a kind of ransomware which can prohibit Windows users from accessing their photos, personal documents, zip files and a host of other files. It makes use of asymmetric encryption i e victims cannot access their files unless they have a private key, which is owned by the malware author and in order to obtain the key, the victim has to pay a ransom amount to the cyber criminal in virtual currency.

How does it work?

The malware enters the user's system through a fake e-mail from Microsoft. Cyber-criminals make use of well-crafted email addresses, such as update@microsoft.com, making it appear as a valid one, along with a subject line 'Windows 10 Free Update' and an attachment. The attachment, once downloaded and executed by the eScan research team, displayed a warning message along with the instruction to pay $600 for the private key within 96 hours. The malicious e-mail was traced to spam servers located in countries such as India, Russia, Thailand, USA and France.

What to do?

* Users can update their current system to Windows 10 in two stages i e Reserve and Upgrade. In the first stage, users need to check whether they have gotten a notification in their taskbar from Windows which will reserve a free copy of Windows 10. Upon clicking the menu present on the top left, it will check your system and run Windows Advisor to make sure that your hardware and software are compatible with Windows 10. Windows 10 will be downloaded once it is available. And the last stage is Installation where users will get a notification that Windows 10 is downloaded and needs to be installed.
* Ensure that your eScan antivirus package is updated with the latest version and latest virus signatures, which will protect your system from all kinds of Malware attacks.
* Configure your antivirus settings to automatically do system updates.
* Keep your computers backed up on an independent drive or by using a cloud backup.
* Make sure you either implement Mailscan at gateway level or enable Mail Anti-virus on endpoint in order to block extensions such as *.EXE, *.SCR, *.JS, *.VBE etc. These attachments could infect your system.
* Beware of the Attachment! (Remember: Brand-name businesses like SARS and banks will rarely send you attachments). Exercise extreme caution with such e-mails, never open an attachment from an e-mail asking for verification. Even if an e-mail seems to come from a familiar address, it does not mean it actually is sent by that person or company - this is called e-mail spoofing!
* When you need to access a secure site, type in the address instead of clicking on the link in an e-mail or document. If you have to click on the link, put your mouse cursor on the link in the e-mail or document to see whether it is actually the address it should be.