QuoteOf the 1,344,669 computers cleaned, this is about 1 in 5, a ratio that’s higher than we typically see even when accounting for the normal, first-month spike which results from adding a new family but not exceptionally so.
To put this in greater perspective the removals of Zbot are almost as many as the removals of the #2 and #3 malware families this month combined (Win32/Vundo and Win32/Bubnix respectively). Approximately 86 million computers have run this version of MSRT as we compile this data so we should expect this number to increase as the month continues.
QuoteUpon execution the ransomware will change the Desktop’s wallpaper to the “Warning! Piracy detected!” background.
It will then make sure the warnings appear every time the end user restarts PCs. In between, it will lock down the end user’s Desktop, featuring the “Copyright violation: copyrighted content detected” window