Threat Database Trojans Trojan.Ransomlock

Trojan.Ransomlock

By ESGI Advisor in Trojans

Threat Scorecard

Threat Level: 90 % (High)
Infected Computers: 67
First Seen: May 1, 2012
OS(es) Affected: Windows

Trojan.Ransomlock is a dangerous Trojan horse parasite that may change settings on a PC that it is installed on. Additionally, Trojan.Ransomlock could allow remote connections making an infected system vulnerable to outside attacks. Trojan.Ransomlock may put stored data at risk of being stolen. It is important to take action to remove Trojan.Ransomlock at once.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
AVG Downloader.Agent2.BMJY
Ikarus Trojan.Win32.Kovter
AhnLab-V3 Trojan/Win32.Agent
McAfee-GW-Edition Heuristic.LooksLike.Win32.Suspicious.C!81
AntiVir TR/Dldr.Agent.xzeh
DrWeb Trojan.DownLoader8.50041
Comodo TrojWare.Win32.Trojan.Agent.Gen
Kaspersky Trojan-Downloader.Win32.Agent.xzem
Avast Win32:Rootkit-gen [Rtk]
McAfee PWS-Zbot-FAYM!DB6ED66B50DA
AVG unknown virus Win32/DH{AwkKD1w}
Comodo UnclassifiedMalware
AVG Ransomer.BNP
Fortinet W32/Agent.WTSK!tr
Ikarus Trojan-Ransomer.BNP

SpyHunter Detects & Remove Trojan.Ransomlock

File System Details

Trojan.Ransomlock may create the following file(s):
# File Name MD5 Detections
1. 1jfuweif.exe 7640f953b6ee2b1c8004038fd15ddd03 25
2. KB0025554.exe db6ed66b50da9e561b7435d656064f0f 15
3. windowshostscr.exe 07e67c21ad11d8ca93c19292d300dcf4 10
4. msvcrt.exe b42ce393cafbd45f51b0e3c60e76646a 8
5. SkypePM.exe ca248577608db2aa7a339596817ed474 5
6. nhxsalid.exe ee9440d8149955e3a7dcda2413c1ac40 2
7. msuoywo.com 5602bfa5ff109a04c1db2169fe7937f8 1
8. {2ED60A26-7E6E-00E7-7956-C4430B7EE929}.exe 895025672cd41df8ecb8a305a67b2026 1
9. %Windir%\ctfmon.exe
10. usrinit.exe
11. Rechnung_Pdf.zip 30cde47eaf866c354293604151b689d6 0
12. file.exe f369a60e652140be46023619ee18f758 0
13. seti0.exe dfe63887d6f18862af960e7fb0dedaa7 0
14. Rechnung.exe 640dc6bd696438ef2bd553c7c75b1996 0

Registry Details

Trojan.Ransomlock may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop\SafeMode
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Userinit" = "%System%\userinit.exe, %System%\usrinit.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot

Related Posts

Trending

Most Viewed

Loading...