Home Malware Programs Trojans Trojan.Ransomlock.F

Trojan.Ransomlock.F

Posted: December 23, 2010

Trojan.Ransomlock.F is a malicious Trojan which ends all programs running on the compromised computer. Trojan.Ransomlock.F also disables the mouse and keyboard and then displays an image that contains Russian text and a pornographic image on the desktop. The warning accompanying the image states:

"WARNING!
You surfed gay porn videos for three hours.
The free viewing time has expired.
To pay for the service, you need to make an online payment through the Beeline system to 9646280479 for the amount of $400 USD.
Upon receipt of the payment you will be given an activation code.
Enter it in the box below and press Enter."

Do not fall for this scam! Remove Trojan.Ransomlock.F immediately before it starts wreaking havoc in your life.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\15886941\15886941.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"15886941" = "%UserProfile%\15886941\15886941.exe"

Additional Information on Trojan.Ransomlock.F

  • The following messages's were detected:
    # Message
    1 "WARNING!
    You surfed gay porn videos for three hours.
    The free viewing time has expired.
    To pay for the service, you need to make an online payment through the Beeline system to 9646280479 for the amount of $400 USD.
    Upon receipt of the payment you will be given an activation code.
    Enter it in the box below and press Enter."
Loading...