Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got virus which tells that all data will be deleted after 12 hours. I cleaned autorun and now scaning my computer with anti-virus, but still is this message just to scary people or is this virus installed something, that will delete data or simply run "format c:" after time passed?

This thing looks like message box in the middle of the screen, that prevents to call anything: task manager or console. Text in that box something like: "You broke the law, so you must pay penalty for this". And there given mobile phone number and field where you must type the code to unlock it, after you payed. Also it says something like: "If you won't pay in 12 hours, your data will be erased and if you try to reinstall windows it will damage your computer".

share|improve this question

closed as off topic by Rory Alsop Apr 28 '12 at 18:06

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

If there data is still accessible, why don't you just make a backup? – CodesInChaos Apr 28 '12 at 9:32
Already done it. I just wonder will be there surprise like data erasing or not. – Dracontis Apr 28 '12 at 13:22
This is not on topic here. Also, as @D.W. has pointed out, there are numerous real and spoof malware applications which could give you what you are seeing. For virus specifics you would be better off looking at Sophos, McAfee, Symantec, Kaspersky etc – Rory Alsop Apr 28 '12 at 18:06
up vote 1 down vote accepted

Winlock is very widespread class of viruses in Russia (classified as Trojan-Ransom by Kaspersky). It's a name for a class of viruses that lock your OS or browser and extort money after it. One subkinds of it may edit hosts file, register, encrypt files, other work using another methods. One will actually delete the data, other will not.

Countermeasures against different viruses are also different. But according to data that you specified you may deal with kind of virus specified here. Translate it into English, if you don't know russian

share|improve this answer

I hate to say it, @Dracontis, but this question does not provide enough information to identify the particular piece of malware you may have, what it may do, or answer your particular questions. It is possible this is simply a piece of "scareware" which tries to scare you -- but it is also possible it might be more nasty and actually delete data.

In any case, it is probably not worth your time to try to identify the exact virus you may have been infected with. Instead, I suggest that you run your anti-virus software to clean up the malware as best as possible. You might also want to consult this Malware Removal Guide for Windows for instructions on how to remove the malware from your machine. After finishing those steps, you might want to backup your data, just in case.

share|improve this answer
Described how this virus looks like. I hope virus appearance looks the same way in any country. – Dracontis Apr 28 '12 at 8:49
@Dracontis - The description provided is to vague, it could be one of an number of variations, of the exact same virus. – Ramhound Apr 30 '12 at 11:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.