Trojan-Ransom.Win32.PornoBlocker.bdi

Technical Details
Payload
Removal instructions

Technical Details

This Trojan stops the computer from functioning in order to obtain a ransom for restoring it. It is a Windows application (PE EXE file). It is 46 080 bytes in size. It is written in Delphi.

Installation

In order to ensure that it is launched automatically each time the system is restarted, the Trojan adds a link to its executable file in the system registry autorun key:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "<path to original Trojan file<"

Payload

This Trojan assigns "hidden" and "system" attributes to its file. It then performs the following actions:

• It adds the following entries to the system registry keys:

  [HKLM\Software\Microsoft\Outlook Express]
  "palo" = "<rnd1>"
  "num" = "<rnd2>"
  

  where <rnd1> is the current date and time in an encrypted form, which comprises 10 digits, for example: "1092554318"

  <rnd2> is the number to refill the account, displayed to the user. It is randomly selected from the list:

  896***29451
  898***36548
  898***36585
  898***32746
  898***36591
  898***36528
  

• It disables the Windows Task Manager by creating the following system registry key:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
  "DisableTaskMgr" = "1"
  

• The Trojan displays its window and in an endless cycle places the input focus in this window:

  

  

This way the Trojan blocks access to other applications and the only thing the user can do is to enter the unblocking code into the corresponding window of this Trojan.

In an endless cycle it also gets the current time and matches it against the system registry key value:

[HKLM\Software\Microsoft\Outlook Express]
"palo" = "<rnd1>"

This way the Trojan ceases running 48 hours since its first launch.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Input the following unblocking code:

   BENOLIMA1

2. Empty the Temporary Internet Files directory:

   %Temporary Internet Files%

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

md5: 6A06F4E5486F7C57B938F4FB6B542960 sha1: FBAFAD67B9E04513BD83EA5410B43EA0BB20CD34

Summary

• Trojan. Changes the system settings of a computer

• Performs potentially dangerous activity

Technical details

File size of 55808 bytes.

Installation

Ensures Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of the following installed files:

by adding values to autorun keys in the system registry:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ] "Shell" = "<­path to source program­><­file of source program ­>"

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ] "userinit" = "<­path to source program­><­file of source program ­>"

Malicious activity

Modifies (or deletes) system registry keys in order to restrict Windows functionality:

[ System registry hive HKEY_CURRENT_USERHKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system ] "DisableTaskMgr" = "0x1"

Description:
­Blocks the Task Manager from opening­

Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Outlook Express ] "mynum" = "89853134558"

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Outlook Express ] "palo" = "1073931474"