Home Malware Programs Trojans Trojan-Ransom.Win32.Chameleon.mw

Trojan-Ransom.Win32.Chameleon.mw

Posted: September 6, 2011

Trojan-Ransom.Win32.Chameleon.mw is a ransomware Trojan that locks up your PC and displays 'La policia ESPAÑOLA' error messages to bully you into paying a fraudulent fine. Although Trojan-Ransom.Win32.Chameleon.mw will use Spanish police logos and other forms of identification to look official, Trojan-Ransom.Win32.Chameleon.mw isn't capable of detecting the adult files that Trojan-Ransom.Win32.Chameleon.mw says are on your PC and has no purpose besides stealing money and blocking access to your computer. Trojan-Ransom.Win32.Chameleon.mw can be detected by the unique message Trojan-Ransom.Win32.Chameleon.mw uses as part of Trojan-Ransom.Win32.Chameleon.mw's ransom scam, as well as the fact that Trojan-Ransom.Win32.Chameleon.mw seeks to stop all application usage of any significance. Despite the powerful nature of Trojan-Ransom.Win32.Chameleon.mw's attacks, SpywareRemove.com malware experts have found that Trojan-Ransom.Win32.Chameleon.mw can be removed effectively by typical anti-malware applications that are supplemented with standard security strategies such as Safe Mode and System Restore.

The Little Lies That Give Away Trojan-Ransom.Win32.Chameleon.mw

Trojan-Ransom.Win32.Chameleon.mw is a Trojan that infects your PC through secretive means, before Trojan-Ransom.Win32.Chameleon.mw locks your entire system down by preventing you from using any major application or system feature. During this lockdown, Trojan-Ransom.Win32.Chameleon.mw will create an error message in Spanish that can be seen below, along with an English translation:

"Su dirección IP ha sido registrada en las webs ilegales con contenido pornográfico orientadas a la difusión de la pornografía infantil, zoofilia e imágenes de violencia contra menores! [...] Además, desde
su ordenador se realiza un envío ilegal (SPAM) de orientación pro terrorista."

English translation: "Your IP address has been recorded in the illegal web content oriented pornographic dissemination of child pornography, bestiality and images of violence against children! [...] In addition, since your computer will perform an illegal shipment (SPAM) orientation pro terrorist."

Despite the overall official-seeming appearance of a Trojan-Ransom.Win32.Chameleon.mw warning, SpywareRemove.com malware experts have had no trouble in tracing Trojan-Ransom.Win32.Chameleon.mw back to Trojan-Ransom.Win32.Chameleon.mw's roots in the form of a clone of 'Die offizielle Mitteilung des Bundeskriminalamtes' ransomware Trojans. Like these German ransomware Trojans, Trojan-Ransom.Win32.Chameleon.mw utilizes the same format, the same threats, the same attack methodologies and even includes equally poor grammar and spelling. Finally, careful readers may also note that the criminals behind Trojan-Ransom.Win32.Chameleon.mw failed to alter one of the German police references from the original message!

The end game for Trojan-Ransom.Win32.Chameleon.mw is to force you to pay a wince-inducing 100 Euro fine to make this lockdown go away, but obviously, there's no reason to do this, when you can just remove Trojan-Ransom.Win32.Chameleon.mw with a good anti-malware program.

Protecting Your PC from Trojan-Ransom.Win32.Chameleon.mw's Fake Police

Trojan-Ransom.Win32.Chameleon.mw does utilize minor network resources to harvest personally-identifiable information about the infected PC, which is simply intended to be displayed to bolster Trojan-Ransom.Win32.Chameleon.mw's own credibility. Other than this network activity and symptoms that have been noted earlier, once Trojan-Ransom.Win32.Chameleon.mw is activated, Trojan-Ransom.Win32.Chameleon.mw may show no signs of being on your PC. Trojan-Ransom.Win32.Chameleon.mw cannot propagate by itself like a virus or worm, although other infections, such as dropper Trojans, may spread Trojan-Ransom.Win32.Chameleon.mw to any computer that comes in contact with the infected PC.

SpywareRemove.com malware research team has also found Trojan-Ransom.Win32.Chameleon.mw under the following aliases: a variant of Win32/Kryptik.PGF, Trj / CI.A, Heur.Suspicious, SHeur3.CFPU and Mal / Generic-L.

Most PC security companies identified Trojan-Ransom.Win32.Chameleon.mw as a PC threat by June of 2011. Anti-malware programs that have threat definition databases that are older than that date may be unable to detect or remove Trojan-Ransom.Win32.Chameleon.mw; as a rule of thumb, keep your security software up-to-date to protect yourself from Trojan-Ransom.Win32.Chameleon.mw and similar Trojan infections.

One Comment

Loading...