TROJ_RANSOM.PRN

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

Installation

This Trojan drops the following non-malicious files:

• %User Profile%\r

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %User Profile%\{random characters}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware file name} = %User Profile%\{malware file name}.exe

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• taskmgr.exe

NOTES:

At first execution, the malware will restart the affected system.

After the machine restarts, it locks the Windows desktop and prompts the user to call a certain number and pay a ransom to receive a key. The system will be unusable until a key is entered correctly:

Based on its codes, the unlock code for this malware is “KVAS”.