Trojan.Ransom.Gen

The Trojan.Ransom.Gen Trojan is the malware infection responsible for many ransomware variants such as the infamous Ukash Virus family as well as North American ransomware infections, such as the FBI Moneypack ransomware threat. Trojan.Ransom.Gen is distributed via malicious email attachments and social engineering attacks targeting inexperienced computer users. Once Trojan.Ransom.Gen infiltrates a computer, Trojan.Ransom.Gen installs a ransomware threat that blocks access to the targeted computer as a way of forcing the victim to pay a large amount of money. If you cannot gain access to your computer due to the presence of an obtrusive, full screen message claiming to belong to law enforcement, ESG security researchers strongly advise using a reliable and fully updated anti-malware application to remove Trojan.Ransom.Gen and its associated malware from your computer permanently.

The basic principle behind most ransomware infections is taking the victim's computer hostage in order to demand a ransom from the computer user. Trojan.Ransom.Gen is not exception; this malware infection prevents the PC user from gaining access to the infected machine. To do this, Trojan.Ransom.Gen creates a fake message from a law enforcement agency. This message varies depending on the victim's computer's IP address. The IP address can be use to determine a computer's geographical location. Using this information, Trojan.Ransom.Gen displays a message in the targeted victim's language and supposedly being sent by the law enforcement agency belonging to the victim's country (for example, victims in the United States receive a message from the FBI while victims in the United Kingdom receive a message from the Metropolitan Police or from Scotland Yard). This message will typically allege that the targeted computer was associated with illegal activities, such as copyright infringement or viewing forbidden pornographic material. It will usually threaten the victim with jail time unless a fine is paid using the Ukash or Moneypak money transfer services.

Since Trojan.Ransom.Gen blocks access to the infected computer, it may be difficult to remove this threat without being able to access anti-malware software on the infected machine. Fortunately, Windows allows computer users to bypass Trojan.Ransom.Gen by using Safe Mode to start up the infected computer. This can also be done by starting up the infected computer from an external memory device, such as a CD or a shared drive.