Content deleted Content added
m moved Trj.PGPCoder.A to PGPCoder: WP naming standard appears to favour common names |
m Spell utilty => utility |
||
Line 11:
Once installed on a computer, the trojan creates two registry keys: one to ensure it is run on every system startup, and the second to monitor the progress of the trojan in the infected computer, counting the number of files that have been analyzed by the malicious code.
Once it has been run, the trojan embarks on its mission, which is to encrypt, using a digital encryption key, all the files it finds on computer drives with extensions corresponding to those listed in its code. These extensions include .doc, .html, .jpg, .xls, .zip and .rar.
The blackmail is completed with the trojan dropping a text file in each directory, with instructions to the victim of what to do. An email address is supplied through which users are supposed to request for their files to be released after paying a ransom of $100-200 to an [[e-gold]] or [[Liberty Reserve]] account.<ref>{{cite web|url=http://rump2008.cr.yp.to/6b53f0dad2c752ac2fd7cb80e8714a90.pdf|format=PDF|title=Cryptanalysis of the Gpcode.ak ransomware virus|author=Eran Tromer|accessdate=2008-09-30}}</ref>
Line 20:
Kaspersky Lab has been able to make contact with the author of the program, and verify that they are the real author, but have so far been unable to determine his real world identity.<ref>{{cite web|url=http://www.techworld.com/security/news/index.cfm?newsid=105043|title=Police 'find' author of notorious virus|date=2008-09-30|publisher=TechWorld}}</ref>
== References ==
{{reflist}}
== External links ==
* Kaspersky Lab
** [http://www.kaspersky.com/find?words=gpcode&search=Search Kaspersky Lab blog posts]
** [http://forum.kaspersky.com/index.php?showforum=91 Kaspersky Lab forum dedicated to GPCode]
** [http://www.viruslist.com/en/find?search_mode=virus&words=Gpcode&x=9&y=5 Kaspersky Lab virus descriptions]
** [http://downloads1.kaspersky-labs.com/utils/stopgpcode/ StopGPCode trojan removal
* Other virus description databases
** [http://www.f-secure.com/v-descs/gpcode.shtml F-Secure]
| |||