What is this thing?

fwor

Good work by Kaspersky and Sophos in publishing ways around this one.

From the description by Sophos:

"a new ransomware attack that appears to have hit computer users via a drive-by vulnerability on compromised websites."

it looks to be based upon someone adding active content (possibly an ActiveX control) to an otherwise innocent website. If correct, you can avoid this drive-by exploit by using the NoScript add-on to Firefox, or by setting your default security level in IE such that active content like ActiveX from untrusted websites will not run. True, it makes browsing a bit cumbersome until you get used to it, but probably worth the small extra effort.

We can probably expect to see a lot more like this. There have already been reports of other ransomware attacks, such as the one (mainly propagating in Japan IIRC) that plants illegal !!!!!! files on your PC and then threatens to report you to the police or your employer if you don't pay up.