TROJ_RANSOM.WR

This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It may be manually installed by a user.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It may be manually installed by a user.

Autostart Technique

This Trojan modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\
WINDOWS NT\CURRENTVERSION\Winlogon
Shell = {malware path and file name}

(Note: The default value data of the said registry entry is Explorer.exe .)

Other System Modifications

This Trojan adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
SYSTEM
DisableTaskMgr = 1

Other Details

This Trojan displays the following images:

It does the following:

• Once executed, it displays a window that prevents any software from execution.
• The displayed window asks for a valid serial number in order to unlock Windows.
• It renames the following registry keys to disable booting in Safe mode:
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal_
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network_
• NOTE: User may use the following code to deactivate the malware: 77294738T