Threat Database Trojans Trojan:Win32/Ransom.DU

Trojan:Win32/Ransom.DU

By JubileeX in Trojans

Trojan:Win32/Ransom.DU is a dangerous Trojan that blocks the infected computer users from accessing their desktop. Trojan:Win32/Ransom.DU creates a window that masks the entire desktop of the corrupted machine, implying that the computer has been included in illegal activities on the web. The created window poses as a warning message that is sent by the German Federal Police. To block the computer user from accessing their desktop, the window is created in such a way so that it is set above all non-topmost windows and should stay above them, even when the window is deactivated. When on a PC, Trojan:Win32/Ransom.DU makes system changes and show pop-up warning messages. The bogus warning messages asks you to pay 100 Euros via Ukash or PaySafeCard to unlock the computer. If your computer has been corrupted by Trojan:Win32/Ransom.DU, you should uninstall it immediately after detection.

File System Details

Trojan:Win32/Ransom.DU may create the following file(s):
# File Name Detections
1. %WINDIR%\ System32\ drivers\ cdrom.sys
2. %WINDIR%\ System32\ drivers\ redbook.sys
3. jashla.exe
4. %WINDIR%\ System32\ drivers\ netbt.sys
5. mahmud.exe
6. %ALLUSERSPROFILE%\ Application Data\ hniYtlAmoTCQf.exe
7. %SystemDrive%\ Users\ pociu76\ AppData\ Roaming\ mahmud.exe

Trending

Most Viewed

Loading...