Home Malware Programs Trojans Ransom-O

Ransom-O

Posted: December 8, 2009

Ransom-O is a malicious Trojan that attaches itself to a corrupt file or spam email message to gain entry to the system. Ransom-O will attempt to block Internet access on the user's system and prompt the user to pay to have the Internet access unblocked. Ransom-O will display a warning saying you must send a SMS containing a code to an unknown number. It will also tell you that attempting to bypass activation system may harm your computer. Do not fall for this trickery and have Ransom-O removed immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Drive%\Program Files\uFast Download Manager\ufastmanager.exe
    2 %Drive%\Program Files\uFast Download Manager\uninstall.exe
    3 c:\Documents and Settings\user\Application Data\uFast Download Manager\PropetyuFastManager.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Explorer\MenuOrder\Start Menu\Programs\Accessories "Order"HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Explorer\MenuOrder\Start Menu\Programs\Accessories\Communications "Order"
Loading...