New ransomware called Anti-Child Porn Spam Protection or ACCDFISA

Greetings everyone. This is my first post to bleeping computer as I'm not an IT pro, just an office manager that just got slammed with this computer today.

Our Win2003 server got infected by this crap today. We had RDP open on both the server AND the router (we are a small office with 10-15 computers), so I'm guessing that's somehow related to how we got it. To make matters worse, it turns out the backups we had been doing (that were setup before I started working in the office) have not been successfully backing up new data for almost two years, even though I thought I was checking the backups. (Side note: NTBackup is a worthless program from what I can tell).

Anyhow, I was just curious if anyone has any new updates on this ransomware? I don't know for sure if our files are actually encrypted or not, but I'm getting the impression that a TON of data will now be gone.

I'm definitely not going to be paying any money to get any purported passwords, since I'm 100% confident that will not do anything constructive. Anyone have any other suggestions on recovering any data? Once we're back up and operational I'll definitely be implementing quite a few new policies to prevent anything this disastrous from happening again in the future.

Hello everyone,
Our windows server 2003 got hit April 18th. I did a lot of reading online on bleepingcomputer.com (my favorite malware site)and also the posting at http://blog.emsisoft.com/2012/04/11/the-accdfisa-malware-family-ransomware-targetting-windows-servers/
The Emsisoft.com site states the hackers enter through RDP. I agree that is how they got into our site, but our administrator password is highly secure, so I do not know how they figured that one out. I decided it would be far less in labor costs to pay the $500.00 ransom and get back to normal. It was only 16 hours after they hit us, so I was well within the stated 48 hours. I sent the payment and 3 hours later, received the reply of:
Hello Thank you for payment.
Unfortunately, but 48 hours has been ended. We wrote about it in our software.
You must pay now 1500$ (you must buy buy additional 1000$ moneypak and send code to us and after this we will get you decryption information)
At that point, I realized I would never get the code, no matter how much money I sent them.
Anyway, I set out to repair the server. Our antivirus and Backup Exec had been deleted, but the infected files (even though they were in Hidden folders), were exactly as bleeping computer described. They were easy to remove and then I ran Malwarebytes just in case and found 1 infected file and 3 registry errors related to the Ransomware. The ipaddress had also been changed. After testing the server to make sure everything was OK, I reinstalled Backup Exec and restored my files (should have done that in the first place). Everything is back to normal and I am grateful to BleepingComputer and Emisoft.com for their information.
From this I have learned to always have good backups, secure your RDP connections to only communicate from one external IPAddress and never pay ransom money.

Hello, My husband has this on his pc and we cant find out how to remove it. I know my way around a computer but am not very technically minded. Does anyone have an idea?

I would be really grateful for some help.

Thanks

Thanks for sharing your experience David.

For those who are affected, please pm me with your version of Windows that was hacked.

Thanks

Sorry should have put this information in my first post.

We are using Windows XP. The Page the virus puts up says "Specialist Crime Directorate" quotes our IP number and says the computer has been locked as it has been used for child porn etdc - it says that we should pay £100 to get it unlocked. Obviously we will not pay anything as it is a scam but we dont know how to remove. We can turn the computer on in safe mode with networking as one site suggested we do this and run Malwarebytes (MBAM) but it didnt find the virus.

Thanks for any help you can give us.

cjulia, yours is a different infection unfortunately.

If you create a new topic in the Virus Removal section and pm me the topic, I will be able to help you there. When creating this topic, also run this program from safe mode and post the logs:

http://www.bleepingcomputer.com/download/anti-virus/dds

I agree that is how they got into our site, but our administrator password is highly secure, so I do not know how they figured that one out

@david

this "hacker" doesn't just hack the admin account, it hacks any account which may be able to log into the machine including the infamous backup account OR test account that is never deleted. there may be a number of accounts besides the administrator account that can gain access to the server and i STRONGLY ENCOURAGE anyone who watches over a domain controller or any server to REMOVE ANY ACCOUNT THAT IS NOT NECESSARY.

this "hacker" doesn't just hack the admin account, it hacks any account which may be able to log into the machine including the infamous backup account OR test account that is never deleted. there may be a number of accounts besides the administrator account that can gain access to the server and i STRONGLY ENCOURAGE anyone who watches over a domain controller or any server to REMOVE ANY ACCOUNT THAT IS NOT NECESSARY.

I agree with this. It's looking like they targeted the "a" account among others when they hit us.

One of my clients got this infection. Looks like it placed files here:
C:\ltejdryo\svchost.exe
C:\mmbdfjil\dc.exe
C:\mmbdfjil\rnuhipnz.list
C:\ProgramData\cstlaabk\svchost.exe
C:\ProgramData\ewumcfai\owlgwqsm.dll
C:\ProgramData\ewumcfai\wotmgebd.dll
C:\ProgramData\ewumcfai\yivkmnzp.dll
C:\ProgramData\ewumcfai\yivkmnzp.dll.dlls
C:\ProgramData\gaxtqtvc\svchost.exe
C:\ProgramData\qxchuygf\cubzzkec.dlls
C:\ProgramData\qxchuygf\tirmjsjj.dlls
C:\ProgramData\stppthmain\stppthmain.dll
C:\Windows\system32\svchostsv.exe
C:\Windows\system32\svschost.exe
C:\Windows\system32\csrss32.dll
C:\Windows\system32\csrss64.dll
C:\Windows\system32\lreuapqg.dll

I did a scan of the drive and it looks like your correct, nothing is recoverable. They were backing up to an external USB hard drive. It appears the hard drive has been securley wiped also, unable to recover ANYTHING from the removable USB drive. At a loss at this point...

Has anyone attempted to crack the archive?

Edited by ITC, 24 April 2012 - 04:56 PM.

PM me the version of Windows.

Just a question here, is there anyway to use a Linux Platform to at least get in and pull the files that we can?

Are the files REALLY locked? Or is this like any other ransomeware / rouge that says the files are locked but their actually there?

Files are password protected rar files.

Any chance what Fabian Wosar posted will still work with the ID they give you?

I know im most likely just restating the obvious.

And any clue if this guy claiming to be the author is actually him?

Edited by Balon, 25 April 2012 - 12:13 PM.

Just a thought, but considering all of these versions are probably by the same guy, and if the phone number in the Malware Protection version is legitimate, could we have the authorities trace the phone to the hacker's residence to stop him?

Just a thought, but considering all of these versions are probably by the same guy, and if the phone number in the Malware Protection version is legitimate, could we have the authorities trace the phone to the hacker's residence to stop him?

I was thinking that or the email. Think about it, the FBI can bind a virus / to a .jpg and email him it. Easily infect him and stop him. Basically back hack what he has hacked then wouldn't we have the passwords to every single .rar?