Threat Database Trojans Trojan:Win32/Loktrom.B

Trojan:Win32/Loktrom.B

By GoldSparrow in Trojans

Trojan:Win32/Loktrom.B is a ransomware Trojan that attacks computers in various countries. Trojan:Win32/Loktrom.B blocks the victimized PC and covers the screen with a false full-screen notification by hiding all other windows, and makes your PC unusable. The misleading message allegedly comes from a legal authority which declares to be related to Windows and Microsoft Security Essentials. The bogus warning message of ransomware claims that illegitimate activity has been detected on your PC, which means that you have violated certain laws. The frightening warning message distributed by Trojan:Win32/Loktrom.B asks a victim to pay a fine to unlock the PC and avoid imprisonment. Trojan:Win32/Loktrom.B may make repeated modifications to the corrupted machine that make it hard for the computer owner to download, install, run, or update anti-virus applications. Trojan:Win32/Loktrom.B may be installed on the targeted computer by other security threats, or it may access the workstation via a drive-by downloads. When run, Trojan:Win32/Loktrom.B modifies the Windows Registry to make sure its copy launches whenever you boot up Windows. Trojan:Win32/Loktrom.B can also set the value as a random string in the registry entry.

SpyHunter Detects & Remove Trojan:Win32/Loktrom.B

File System Details

Trojan:Win32/Loktrom.B may create the following file(s):
# File Name MD5 Detections
1. 6979999.exe 87ff01ce77ab71cc4953c6cbca3ef96b 0
2. 4655818.exe._ 930935904e8d2914953b0e3b63be2656 0
3. 2606981.exe d09c386f3bb13aacf185afbbc87f5802 0
4. xxx_video.exe 7469d2bce990dc340841698795a6174b 0

Registry Details

Trojan:Win32/Loktrom.B may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon "Shell" = "[MALWARE FILE NAME]"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "explorer" = "[MALWARE FILE NAME]"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM NAME]", for example "S1249087" = "[MALWARE FILE NAME]"

Trending

Most Viewed

Loading...