Trojan.Ransomlock.H
Trojan.Ransomlock.H is a threat that will render computer unusable by locking the desktop and seek payment to unlock it. Trojan.Ransomlock.H virus can be acquired by visiting malicious and explicit web sites. When executed, the Trojan will modify settings on the PC and displays an image containing Russian language. To prevent the removal of Trojan.Ransomlock.H, this Trojan will intentionally disables Windows Task Manager and other useful functions.
Screen Shot Image:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7
First Aid to Stop Trojan.Ransomlock.H:
When Trojan.Ransomlock.H infects a computer, it will modify system setting and inject itself to legitimate Windows files. System Restore is the tool-to-go-to in bringing back clean files and restoring earlier configuration. If you have saved previous restore point, please restore Windows to an earlier date.
Manual Removal of Trojan.Ransomlock.H:
1. If an anti-virus program is present, update the definition file.
2. Reboot Windows in SafeMode [how to]
3. Run a full system scan and clean/delete all infected file(s)
4. Delete/Modify any values added to the registry if present. [how to edit registry]
5. Exit registry editor and restart Windows.
Additional Tools and Programs:
Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.
Technical Details and Additional Information:
Other functionalities of this Trojan:
- Force victims to send premium-rate SMS to acquire the unlock code.
- Ends process Display a malicious HTML files.
Malicious Files Added by Trojan.Ransomlock.H:
%CurrentFolder%\[RANDOM NUMERIC CHARACTERS].bat
%Temp%\[RANDOM ALPHANUMERIC CHARACTERS].tmp
Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[TEN RANDOM NUMBERS]” = “%UserProfile%\[TEN RANDOM NUMBERS].exe”