“The virus cause the PC to freeze and lock,” a Met Police spokesman said, adding that officers were working on an international investigation of the virus spearheaded by German authorities, who have discovered the most victims.
“Genuine law enforcement agencies would never contact members of the public via this method and demand funds in this way,” the spokesman said.
The message that appears on infected machines is designed to scare victims into paying the “fine” via difficult-to-trace online payment methods.
“Forbidden websites containing pornography, child pornography... were visited from this IP address.
“This locking serves to stop you illegal activity.”
The professional cyber criminals behind the virus are spreading it to victims’ Windows computers by hacking into legitimate websites and inserting their malicious software, an off-the-shelf hacking tool called BlackHole. Licences to use the tool are sold online for $2,000.
The security firm F-Secure said thousands of web users have been affected in 13 countries since March. Once a victim’s computer is infected, the criminals detect their location and issue a bogus demand from a local law enforcement agency in the local language.
Mikko Hypponen, F-Secure’s chief research officer, said most victims became infected because they did not keep their browser add-ons up-to-date.
“Computers get infected because they have an outdated version of Java, Flash or some other add-on,” he said.
“The infection is invisible to the end user until the user reboots the computer.”
The Met said those affected should not hand over any money or bank details in an effort to unlock their computer. The majority of known British victims had not, it added.
“We would advise anyone who has been deceived by such a message and handed over monie should report the matter to the card issuer immediately and report the offence to their local police by dialling "101" or the local non-emergency police number,” the Scotland Yard spokesman said.
Mr Hypponen said computer users should back up their data in case they fall victim to the “ransomware” scam. Details of how to manually remove the infection have been posted online.
