Sunbelt Provides Decryptor for Ransomware Trojan

The Sunbelt Software Malware Research Team discovered a new ransomware Trojan on Wednesday, which appeared to be pushed onto the system via the IFRAMEDOLLARS adware. According to Sunbelt, the Trojan (dubbed Trojan.Ransom.AT) "encrypts files with the extensions txt, xls, doc, pps, ppt, docx, xlsx, pptx, rtf, mdb, vsd, vst, csv, mpl, zip, and rar". The ransomware Trojan then displays a text file that claims to have encrypted the files for your own protection, stating in part:

"For your security we did it before than someone else: hacker, virus or just stupid vandal.
In world, hijackers are hunting for your bank account, credit card information, or something valuable.
Now, even if they'll hack your computer they steal nothing, because all of your important files are now crypted and secured."

The text file then goes on to explain that in order to decrypt the files, you'll need to send $150 USD to the attackers via Western Union. Fortunately, the folks at Sunbelt Software obtained a copy of the decryptor and are offering free assistance to recover the files of those impacted.

For further details, check the following links which point to Sunbelt's blog:

New ransomware

Possible decryptor available for Trojan Ransom.AT

This makes it all worth it...

Kudos to Alex Eckelberry and all the good folks at Sunbelt Software for helping folks recover from this bit of nastiness.