WinBan Ransomware

PC security researchers have noticed a ransomware Trojan that seems to be still under development. The WinBan Ransomware is submitted to online anti-virus platforms, which are used by con artists to test their ransomware creations commonly, as a way to detect whether their attacks can bypass detection by popular anti-virus programs. This, in turn, allows PC security analysts to detect early versions of threats like the WinBan Ransomware and prepare computer users to protect their computers against them and any new tactics being used by the con artists in these attacks.

The Illegal Ban of Your Files Caused by the WinBan Ransomware

The WinBan Ransomware may be delivered in the form of Microsoft Word documents attached to unsolicited email messages. These attachments will include macro scripts that download and install the WinBan Ransomware on the victim's computer. Once the WinBan Ransomware is installed, it will display a lock screen, which will prevent computer users from accessing the infected computer. The WinBan Ransomware claims to be associated with a technical support company, supposedly claiming that the victim's 'Windows was banned.' The WinBan Ransomware's lock screen barely makes sense, both from a technical standpoint and because it is written in very poor English, which should be a red flag to anyone that may still be mistaking the WinBan Ransomware for a legitimate message from Windows or a real technical support company. The WinBan Ransomware disables the Windows Registry Editor, the Task Manager, keyboard shortcuts, and other features that could be used to bypass messages like the one displayed by the WinBan Ransomware, making it difficult to access the infected computer.

The WinBan Ransomware’s Lock Screen and Message

The following is the message the WinBan Ransomware displays in its lock screen:

'Your Windows has been Banned
our windows has been banned and Microsoft has been detected an unsolvable threat and this threat can result a great loss to your computer and its been violated the terms of Microsoft e (Microsoft) will not be responsible for any kinds of ban
our PC has been banned, and you cannot access your PC right now and it is very much bad for you. We have covered 2 options for
1.Install new windows
2.Verify your windows
The choice is yours, if you choose number 1, We are going to delete all your files from your computer and ban you from your PC, if you choose 2nd one refers if you want your files back. Click the bellow button (what to do) and you need to pay Micros Tech assistant and he will give yo a code then you can get your files back
Solution
Microsoft Tech People Around
NAME:Error Coder
Phone Number:+40752512657
Contact:robertnedela15@gmail.com
Already got your code? Submit it here [TEXT BOX] Submit'

The WinBan Ransomware lock screen can be removed with the code '4N2nfY5nn2991,' which is hard coded in the WinBan Ransomware's programming. After this code is entered, the WinBan Ransomware lock screen will disappear, and the following message will appear:

'Windows Succesfully Upgraded
You need to make jost some more things to do:
1.Restart your computer
3.Then go to the startup folder Win + R ----> Startup
2.If error persists give the password "Give your password"
And one more thing:You have been fooled by Anonymous.We are not Microsoft repair mans. Have a nice day (^_^)
Created by Anonymous--
Windows upgrade tool All Rights Reserved'

Although this second message claims to have been sent by Anonymous, there is no evidence that the WinBan Ransomware is anything but an individual's attempt to profit at the expense of computer users. PC security researchers strongly advise computer users to refrain from contacting any phone number or email address associated with the WinBan Ransomware attack. Even if a newer version with a different password is installed on your computer, the WinBan Ransomware lock screen can be bypassed by starting up Windows using an alternate start-up method or Safe Mode, both of which will prevent the WinBan Ransomware from starting up along with Windows and blocking access to the infected computer to carry out the attack.

SpyHunter Detects & Remove WinBan Ransomware