Win32/Weelsof  is a family of ransomware trojans that targets users from certain countries. It locks your computer and displays a localized webpage that covers your desktop and demands the payment of a fine for the supposed possession of illicit material.

Some variants of Win32/Weelsof may make lasting changes to your computer that make it difficult for you to download, install, run, or update your virus protection. For specific recovery information, please see the relevant variant's entry in the encyclopedia and the Additional recovery instructions in this entry.

System changes

The following system changes may indicate the presence of this malware:

• The presence of files such as the following:
  

  %APPDATA%\pjqjsyrlgbgksrv
  %APPDATA%\tulpmjllloozzic
  

• The presence of the following registry modifications:
  
  

  In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Sets value: "<random string>", for example "aefgvpwpvqxksk" 
  With data: "%windir%\<random filename>.exe", for example "dtikagusucrjujsfkutt.exe"

  In subkey: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
  Sets value: "Shell"
  With data: "%APPDATA%\<random filename>.exe, for example "dtikagusucrjujsfkutt.exe"

• The display of images such as the following:
  
  An image pretending to be from the Policja; the Polish police force:
  

   

   An image pretending to be from the Politie; the Dutch police:

  

  An image pretending to be from the Elliniki Astynomia; the Greek police:

  

  Images pretending to be from the Federal Bureau of Investigation; the FBI:

  

  

  An image pretending to be from the Cuerpro Nacional De Policia; the National Police Corps of Spain:

  

  An image pretending to be from the Policia de Seguranca Publica; the Public Security Police of Portugal:

  

  An image pretending to be from the Polizia di Stato; the State Police of Italy:

  

  An image pretending to be from Polisen; the Swedish Police Service:

  

  An image pretending to be from the Gendermarie Nationale; the National Gendarmarie of France:

  

  An image pretending to be from An Garda Siochana; the Irish National Police Service:

  

  An image pretending to be from the Bundespolizei; the German Federal Police:

  

Win32/Weelsof  is a family of ransomware trojans that targets users from certain countries. It locks your computer and displays a localized webpage that covers your desktop and demands the payment of a fine for the supposed possession of illicit material.

Installation

When run, variants of Win32/Weelsof copy themselves to the %APPDATA% or %windir% folder with a random filename, for example "vtamqgcq.exe" or "hqbltqpc.exe".

Note: %APPDATA% refers to a variable location that is determined by the malware by querying the operating system. The default location for the Application Data folder for Windows 2000, XP, and 2003 is "C:\Documents and Settings\<user>\Application Data". For Windows Vista and 7, the default location is "C:\Users\<user>\AppData\Roaming".

Note: %windir% refers to a variable location that is determined by the malware by querying the operating system. The default installation location for the Windows folder for Windows 2000 and NT is "C:\WinNT"; and for XP, Vista, and 7 it is "C:\Windows".

Variants of Win32/Weelsof modify the following registry entries to ensure that their copy runs at each Windows start:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<random string>", for example "aefgvpwpvqxksk" 
With data: "%windir%\<random filename>.exe", for example "dtikagusucrjujsfkutt.exe"

In subkey: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
Sets value: "Shell"
With data: "%APPDATA%\<random filename>.exe, for example "dtikagusucrjujsfkutt.exe"

Payload

Prevents you from accessing your desktop

Variants of the Win32/Weelsof family display a full-screen webpage that they download from a remote host. The page covers all other windows, rendering the computer unusable. It is a fake warning pretending to be from a legitimate institution which demands the payment of a fine.

Paying the "fine" will not necessarily return your computer to a usable state, so this is not advisable.

These displayed webpages may be detected as a variant of the Trojan:HTML/Ransom family, such as Trojan:HTML/Ransom.A.

Some examples of localized webpages that variants of Win32/Weelsof may display are reproduced here.

An image pretending to be from the Policja; the Polish police force:

 An image pretending to be from the Politie; the Dutch police:

An image pretending to be from the Elliniki Astynomia; the Greek police:

Images pretending to be from the Federal Bureau of Investigation; the FBI:

An image pretending to be from the Cuerpro Nacional De Policia; the National Police Corps of Spain:

An image pretending to be from the Policia de Seguranca Publica; the Public Security Police of Portugal:

An image pretending to be from the Polizia di Stato; the State Police of Italy:

An image pretending to be from Polisen; the Swedish Police Service:

An image pretending to be from the Gendermarie Nationale; the National Gendarmarie of France:

An image pretending to be from An Garda Siochana; the Irish National Police Service:

An image pretending to be from the Bundespolizei; the German Federal Police:

Connects to remote servers

In the wild, we have observed Win32/Weelsof downloading the webpages from the following remote hosts via HTTP port 80:

• dolores.cursopersona.com
• fridayaddon.info
• frivnrifr771kfii3834.info
• ginnsuilspe94mdjjs.info
• Locks the computer
• pictureicon.org.uk/arch/design_F4000000
• pictureicon.org.uk/topic.php
• pictureinput.org.uk/bbac4/1/arch/design_F4000000
• pictureinput.org.uk/bbac4/1/topic.php
• pictureinteractive.org.uk/bbac4/2/arch/design_F4000000
• pictureinteractive.org.uk/bbac4/2/topic.php
• pictureinternet.org.uk/adv/topic.php
• pictureinternet.org.uk/bbac4/1/topic.php
• pictureinternet.org.uk/bbac4/2/topic.php
• pictureinternet.org.uk/topic.php
• picturekeyboard.org.uk/arch/design_F4000000
• picturekeyboard.org.uk/topic.php
• policebrave.info/get_dsn.php
• policebrave.info/topic.php
• policebreakable.info/get_dsn.php
• policebreakable.info/topic.php
• policebreezy.info/get_dsn.php
• policebreezy.info/topic.php
• police-center.in/bbac/arch/design_F4000000
• police-center.in/bbac/topic.php
• police-central.in/bbac3/1/arch/design_F4000000
• police-central.in/bbac3/1/topic.php
• police-central.in/bbac3/2/arch/design_F4000000
• police-central.in/bbac3/2/topic.php
• police-central.in/bbac3/3/arch/design_F4000000
• police-central.in/bbac3/3/topic.php
• police-central.in/bbac3/4/arch/design_F4000000
• police-central.in/bbac3/4/topic.php
• re4rwe3sg4744pps5e.info
• serveranxious.in/arch/design_F4000000
• serveranxious.in/topic.php
• sogood.vitaminavip.com
• solovely.kugufejupaqajax.info
• sosexy.baby300.info/1/get_dsn.php
• sosexy.baby300.info/1/topic.php
• stiloveu.obavestime.com/adv/arch/design_F4000000
• stiloveu.obavestime.com/adv/topic.php
• stiloveu.obavestime.com/arch/design_F4000000
• stiloveu.obavestime.com/topic.php
• trybesmart.in/dilly/desi_F4000000
• trybesmart.in/dilly/get_ip.php
• trybesmart.in/dilly/index6.php
• ultimategood.info/200/arch/design_F4000000
• ultimategood.info/200/topic.php
• ultimategood.info/adv/arch/design_F4000000
• ultimategood.info/adv/topic.php
• ultimategood.info/arch/design_F4000000
• ultimategood.info/topic.php
• uniquegood.info/adv/arch/design_F4000000
• uniquegood.info/adv/topic.php
• uniquegood.info/arch/design_F4000000
• uniquegood.info/topic.php
• urbangood.info/adv/arch/design_F4000000
• urbangood.info/adv/topic.php
• urbangood.info/arch/design_F4000000
• urbangood.info/topic.php
• verywell.xan7rafx.biz
• vjnfnjfmio3rejioref.ru/adv/topic.php
• vjnfnjfmio3rejioref.ru/topic.php
• weelsoffortune.info/dilly/desi_F4000000
• weelsoffortune.info/dilly/get_ip.php
• weelsoffortune.info/dilly/index2.php
• weelsoffortune.info/dilly/index4.php
• weelsoffortune.info/dilly/index5.php

Additional information

We have observed Win32/Weelsof using a variety of legitimate payment and financial transfer services, including the following:

• Green Dot MoneyPak
• Paysafecard
• Ukash
• Ultimate Game Card

Note: These providers are not affiliated with Win32/Weelsof.

If you believe you are a victim of fraud involving one of these services, you should contact them along with your local authorities.

Please also see the following Microsoft advisory for additional advice:

• What to do if you are a victim of fraud

 Win32/Weelsof also drops a file with a randomly generated name of 15 characters into the %APPDATA% folder, for example:

• %APPDATA%\tulpmjllloozzic
• %APPDATA%\pjqjsyrlgbgksrv

Related encyclopedia entries

Trojan:HTML/Ransom.A

Analysis by Patrick Estavillo

Take the following steps to help prevent infection on your computer:

• Enable a firewall on your computer.
• Get the latest computer updates for all your installed software.
• Use up-to-date antivirus software.
• Limit user privileges on the computer.
• Use caution when opening attachments and accepting file transfers.
• Use caution when clicking on links to webpages.
• Avoid downloading pirated software.
• Protect yourself against social engineering attacks.
• Use strong passwords.

Enable a firewall on your computer

Use a third-party firewall product or turn on the Microsoft Windows Internet Connection Firewall.

• How to turn on the Windows Firewall in Windows 7
• How to turn on the Windows Firewall in Windows Vista
• How to turn on the Windows firewall in Windows XP

Get the latest computer updates

Updates help protect your computer from viruses, worms, and other threats as they are discovered. It is important to install updates for all the software that is installed in your computer. These are usually available from vendor websites. Instructions on how to download the latest versions of some common software is available from the following:

• Microsoft Malware Protection Center - Updating Software

You can use the Automatic Updates feature in Windows to automatically download future Microsoft security updates while your computer is on and connected to the Internet.

• How to turn on Automatic Updates in Windows 7
• How to turn on Automatic Updates in Windows Vista
• How to turn on Automatic Updates in Windows XP

Use up-to-date antivirus software

Most antivirus software can detect and prevent infection by known malicious software. To help protect you from infection, you should always run antivirus software, such as Microsoft Security Essentials, that is updated with the latest signature files. For more information, see 'Consumer security software providers'.

Limit user privileges on the computer

Starting with Windows Vista and Windows 7, Microsoft introduced User Account Control (UAC), which, when enabled, allowed users to run with least user privileges. This scenario limits the possibility of attacks by malware and other threats that require administrative privileges to run.

You can configure UAC in your computer to meet your preferences:

• User Account Control in Windows 7
• User Account Control in Windows Vista
• Applying the Principle of Least Privilege in Windows XP
• More on User Account Control

Use caution when opening attachments and accepting file transfers

Exercise caution with email and attachments received from unknown sources, or received unexpectedly from known sources. Use extreme caution when accepting file transfers from known or unknown sources.

Use caution when clicking on links to webpages

Exercise caution with links to webpages that you receive from unknown sources, especially if the links are to a webpage that you are not familiar with, unsure of the destination of, or suspicious of. Malicious software may be installed in your computer simply by visiting a webpage with harmful content.

Avoid downloading pirated software

Threats may also be bundled with software and files that are available for download on various torrent sites. Downloading "cracked" or "pirated" software from these sites carries not only the risk of being infected with malware, but is also illegal. For more information, see 'The risks of obtaining and using pirated software'.

Protect yourself from social engineering attacks

While attackers may attempt to exploit vulnerabilities in hardware or software to compromise a computer, they also attempt to exploit vulnerabilities in human behavior to do the same. When an attacker attempts to take advantage of human behavior to persuade the affected user to perform an action of the attacker's choice, it is known as 'social engineering'. Essentially, social engineering is an attack against the human interface of the targeted computer.

Use strong passwords

Attackers may try to gain access to your Windows account by guessing your password. It is therefore important that you use a strong password – one that cannot be easily guessed by an attacker. A strong password is one that has at least eight characters, and combines letters, numbers, and symbols. For more information, see 'Create strong passwords'.

Some variants of Win32/Weelsof may make lasting changes to your computer that make it difficult for you to download, install, run, or update your virus protection. For specific recovery information, please see the relevant variant's entry in the encyclopedia and the Additional recovery instructions below.

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

• Microsoft Security Essentials  or, for Windows 8, Windows Defender
• Microsoft Safety Scanner
• Microsoft Windows Malicious Software Removal Tool

The Win32/Weelsof family attempts to steal sensitive and confidential information from affected users to perpetrate fraud. If you believe that your personal financial information may have been compromised, please refer to the following advisory for additional advice:

• What to do if you are a victim of fraud

Additional recovery instructions

This threat may prevent you from accessing your computer's desktop, so you may need to boot to a trusted environment in order to detect and remove it. The threat may also make changes to your computer that makes it difficult for you to download, install, run, or update your virus protection, whether you have a complete antivirus such as Microsoft Security Essentials installed on your computer or not.

If you suspect your computer has been compromised, we recommend using the Windows Defender Offline to detect and remove this threat.

Using Windows Defender Offline

The way Windows Defender Offline works, is by allowing you to:

• Download a copy of the tool from a computer that has access to the internet
• Save a copy of the recovery tool to a removable drive, in order to create bootable media
• Run the recovery tool on a compromised computer

You might want to use Windows Defender Offline when:

• You need to scan your computer to check for rootkits and other malware
• You are infected with malware that prevents you from downloading and installing an antivirus or the latest updates for your antivirus software
• Your antivirus does not detect or remove advanced malware, such as a rootkit

Note: Windows Defender Offline is not a replacement for a full antivirus solution providing ongoing protection; it is meant to be used in situations where you cannot start or otherwise effectively scan your infected computer due to a virus or other malware actively running on the computer and impeding the effective action of antimalware software. For no-cost, real-time protection that helps guard your home or small business computers against viruses, spyware, and other malicious software, download Microsoft Security Essentials.

1. Determine if you require the 32-bit or 64-bit download.
   
   See the Microsoft Help and Support article for instructions on how to determine whether a computer is running a 32-bit version or 64-bit architecture of the Windows operating system.
2. Using a computer that can connect to the internet, download the version of the Windows Defender Offline that applies to the affected computer.
   
   If the affected computer is a:
   
   - 32-bit computer, then download the 32-bit version here.
   - 64-bit computer, then download the 64-bit version here.
   
   Note: In order for the recovery tool to be effective, make sure you download the version that matches the architecture of the affected computer. For example, if your 64-bit desktop is affected, you will need to download the 64-bit version of the Windows Defender Offline and save it to a removable drive.
3. Save the downloaded file to a local drive on your computer.
4. Launch the downloaded file, and create a bootable device by following the instructions on the wizard.
   
   Note: We recommend creating a bootable USB or CD; if you create a bootable USB, this can be updated for future use.
5. From the affected computer, boot from the USB or CD you created in step 4.
   
   Note: You may need to set the boot order in the BIOS to do this. This will be device specific, so if you are unsure, refer to your system manual or manufacturer.
6. Follow the prompts to run a full system scan.
   
   Depending on the outcome of the scan, your next steps will vary. Follow the prompts from Windows Defender Offline to manage any threat detections.

Steps you can take once your computer has been cleaned

• Install security software, such as Microsoft Security Essentials, or any number of other products that provide a complete, real-time antivirus solution.
• Keep your antivirus up to date by making sure you have the latest definitions.
• Use the Microsoft Safety Scanner if you suspect you are infected but are unable to confirm this with your existing antivirus solution.