'Canadian Security Intelligence Service (CSIS) Pop-up Alert' Details

[+] Click Image to Enlarge

• 

The Canadian Security Intelligence Service (CSIS) pop-up alert and the Ukash Virus

Until recently, the infamous Ukash virus had only attacked computer systems located in Europe. However, recent versions of this Winlocker have appeared targeted towards computer users in the United States and Canada. For a long time, the Ukash virus (known for such ransomware as the Metropolitan Police attack) was a relatively obscure malware attack. However, ESG security analysts detected a few months ago that the criminals behind this virus made the Canadian Security Intelligence Service (CSIS) pop-up alert available on an affiliate basis, allowing hackers to profit by infecting as many computer as possible with the Canadian Security Intelligence Service (CSIS) pop-up alert. In the last couple of years, this has given rise to a host of different versions of this Winlocker, in a dozen of languages and impersonating dozens of different law enforcement agencies around the world. The Canadian Security Intelligence Service (CSIS) pop-up alert is basically the Canadian version of this fake police message. Make no mistake about it, the Canadian Security Intelligence Service (CSIS) pop-up alert has no relationship to the CSIS but is actually part of a well-known malware infection.

How the Canadian Security Intelligence Service (CSIS) Pop-up Alert Scam Works

Like other versions of the Ukash virus, the Canadian Security Intelligence Service (CSIS) pop-up alert claims to be a message from the CSIS claiming that the infected computer system was associated with websites containing illegal pornographic content, such as child pornography or bestiality. It threatens to initiate legal action against the computer user unless the victim pays a one hundred Canadian dollar fine, through the money transfer service Ukash.

The Canadian Security Intelligence Service (CSIS) pop-up alert infection blocks all access to the Task Manager and to the infected computer’s desktop, essentially taking the infected computer system hostage until the victim pays the fine. However, this infection is not particularly sophisticated. ESG malware analysts recommend starting up in Safe Mode or from an alternative boot method in order to bypass the Canadian Security Intelligence Service (CSIS) pop-up alert. Once this is done, the victim can remove the Canadian Security Intelligence Service (CSIS) pop-up alert with a reliable anti-virus program. Computer users with the knowledge necessary to manipulate the Windows Registry can also manually edit the registry in order to prevent the Canadian Security Intelligence Service (CSIS) pop-up alert from launching automatically. Then, it is a simple matter of locating and removing all files associated with this threat.

How Can You Detect Malware Files Related to ‘Canadian Security Intelligence Service (CSIS) Pop-up Alert’?

Canadian Security Intelligence Service (CSIS) Pop-up Alert Technical Report

As new Canadian Security Intelligence Service (CSIS) Pop-up Alert details are reported by our customers and findings from our Threat Research Center, we will update this section.

Fake message for Canadian Security Intelligence Service (CSIS) Pop-up Alert:

The following fake error message(s) appears for Canadian Security Intelligence Service (CSIS) Pop-up Alert:

Government of Canada
Gouvernement du Canada
Canadian Security Intelligence Service
Service canadien du renseignement de sécurité
www.csis.gc.ca
Attention!!!
This operating system is locked due to the violation of the laws of the Canada!
Following violations were detected: Your IP address is [removed]. This IP address was used to visit websites containing pornography, child pornography, zoophilia and child abuse. Your computer also contains video files with pornographic content, elements of violence and child pornography! Spam-messages with terrorist motives were also sent from your computer.
This computer lock is aimed to stop your illegal activity.
To unlock the computer you are obliged to pay a fine of $ 100.
You must pay the forfeit through Ukash:
To do this, you should enter the 19 digits code in the payment form and press OK (if you have several codes, enter them one after the other and press OK).
If an error occurs, send the codes to address deposit@canada.gov

Important Article Disclaimer