View source for Scareware locks down computer due to child porn and terrorism

{{Publication
|Image=scareware_lock_down.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.abuse.ch/?p=3610 abuse.ch
|Author=, 
|NomRevue=The Swiss Security Blog
|Date=March 2, 2012
|Editor=abuse.ch
|Year=2012
|ISBN=
|Page=
|Abstract=Recently, my sandbox came across a scareware that locks down the victim’s computer due to “terrorism and child pornography”. The malware is being detected by some AV vendors as “Win32/LockScreen”.

The schema is pretty simple: The criminals try to infect computers with scareware (eg. through Drive-By exploits). As soon as the computer is infected, the malware locks down the machine so that the user won’t be able to log in any more. The malware then displays a message to the user that the law enforcement agency XY found child pornography on the victims computer and that the his computer was used to send out “spam mails with terrorist motives”:
|Botnet=Goldenbaks, 
|Malware=Lockscreen, 
|CCProtocol=HTTP, 
|Operation=, 
|Keyword=Ransomware, Gendarmerie, 
}}