Trojan.Ransom.Gen

Posted: September 27, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	87

First Seen:	September 27, 2012
OS(es) Affected:	Windows

Trojan.Ransom.Gen is a heuristic detection for ransomware from various branches of the Ukash Virus family, with confirmed Trojan.Ransom.Gen infections centering around Germany and United States-based attacks. Like any member of its family, Trojan.Ransom.Gen launches itself automatically (usually after related PC threats force your computer to reboot) and displays a fake legal warning that prevents you from using other programs or, in fact, the rest of the Windows interface. While Trojan.Ransom.Gen is still very much an active threat – particularly for residents of Germany - SpywareRemove.com malware researchers still recommend the same solution to Trojan.Ransom.Gen that applies to other ransomware from the Ukash Virus family: disabling Trojan.Ransom.Gen with appropriate techniques (as described in this article) and then deleting Trojan.Ransom.Gen with an anti-malware scanner, as opposed to paying its fake fee.

Trojan.Ransom.Gen: Why Germany's Problem Might Be Yours, Too

Most commonly, Trojan.Ransom.Gen is used to identify ransomware trojans that target Germany, with one repeat offender being the Bundespolizei Ukash Virus (also identified as Win32/LockScreen.AJA, W32/Ransom.UK or Trojan-Ransom.Win32.Blocker.bly). However, Trojan.Ransom.Gen can also apply to other trojans from the same family, including trojans that have targeted other countries, like the American-preferring FBI Green Dot Moneypak Virus. Because Trojan.Ransom.Gen lacks any self-propagation capabilities, the majority of Trojan.Ransom.Gen attacks involve a related trojan, such as a trojan dropper, that installs Trojan.Ransom.Gen on your system. Typically, your PC is then rebooted to allow Trojan.Ransom.Gen to launch its attack.

Trojan.Ransom.Gen's payload consists of a generalized legal alert, with the language and legal references pertaining to the geography of your IP. For example, PCs that use German IP addresses will be forced to display a fake notice from the Bundespolizei, while a US-based computer may display an alert supposedly from the United States FBI. In all cases, Trojan.Ransom.Gen's popup warning claims that your computer has been locked due to various illegal acts, although SpywareRemove.com malware experts emphasize that no version of the Ukash Virus, including Trojan.Ransom.Gen, is associated with any form of real law enforcement.

Blasting a Hole in Trojan.Ransom.Gen's Nigh-Impenetrable Popup

Due to Trojan.Ransom.Gen's pop-up preventing you from accessing the rest of Windows, it may be tempting to pay Trojan.Ransom.Gen's fake legal fine, which is transferred through such methods as Ukash, Moneypak and Paysafecard. However, SpywareRemove.com malware researchers advise against spending money on the Trojan.Ransom.Gen's bluster, since there are ways to remove Trojan.Ransom.Gen and related PC threats without any financial or, of course, legal penalties.

Trojan.Ransom.Gen should be disabled before you try to remove Trojan.Ransom.Gen in the first place; you can avert Trojan.Ransom.Gen's Registry-based startup mechanism with either Safe Mode or a system boot from a USB device. Once you can launch Windows without Trojan.Ransom.Gen's fake popup appearing, SpywareRemove.com malware analysts encourage you to scan your entire PC and delete Trojan.Ransom.Gen and anything else that may have accompanied it into your hard drive. Most anti-malware products have had various identifying entries for Trojan.Ransom.Gen and similar ransomware trojans well prior to the time of this article's writing.

Trojan.Ransom.gen!E

Trojan.Ransom.Gen

Threat Metric

Trojan.Ransom.Gen: Why Germany's Problem Might Be Yours, Too

Blasting a Hole in Trojan.Ransom.Gen's Nigh-Impenetrable Popup

Related Posts

Leave a Reply