Trojan Ransom

Trojan Ransom




This trojan blocker ( MD5: b72a1ffd702f73080c7ab9ff26ba64ce, be1589b12b771ca6ba41b9e4c82ec9aa, d4a0afcc3471878014f4b64780245054 ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.


WebMoney: B208016071489
WebMoney: U264040669509
Phone: 988-185-37-42
Code to unlock windows: 2348

Russian text:
????????? ????????????!
??? ????????? ???????????? ?? ????????, ??????????? ? ?????????????
???????????????, ?????????? ???????? ???????????, ????????? ? ??????? ??? ??????.
??? ?????? ?????????? ??? ?????????? ???????? ????? ? ???????
600000 ??. ??????   ?  WebMoney ???????
B208016071489
 ?????? ?????? ????? ?????????? ? ????? ????????? ?????????.
? ?????? ?????? ????? ?????? ?????? ???? ??????????? ?? ?? ??????????
???? ????????? ????? ????????? ??? ?????????????. ??? ????? ??????
? ???? ? ?????? ????? ???? ? ?????? ?????? "Enter". ????? ??????
?????????? ?? ?????? ??????? ??? ????????? ?????????? ???????? ???????????,
??????? ? ?????????. ???? ? ??????? 12 ????? ????? ?? ????? ???????, ??? ??????
?? ????? ???????????? ?????????? ????? ???????????? ???????, ? ????
????? ???????? ? ??? ??? ??????????????? ?? ?????? 343 ?.1 ?? ??.
? ? ? ? ? ? ? ? !
???????????? ??? ?????????? ?????????? ???????? ? ?????????????????
???????? ???? ??????, ??????? ??? ???????????? ??????? ? BIOS,
? ?????????????? ??????????? ??????????????.

?????? 343.1. ???????????? ? ??????????????? ???????????????? ?????????? ??? ?????????.
???????????? ???? ???????? ? ????? ??????????????? ??? ??????????????, ???? ??????????????? ???
?????????????? ???????????????? ?????????? ??? ???????? ???????, ???? ????????? ?????????????????
????????? ? ???????????? ???????? ???????????????????, ???? ????????? ???????????? ????- ???
???????????? ????????????????? ?????????? ? ????? ???????????? - ???????????? ???????????????
???????? ?? ???? ?? ???? ???, ??? ??????? ?? ???? ?? ????? ???????, ??? ???????????? ??????? ?? ????
?? ??????? ???.

Translation (thanks @Malwageddon)
COMPUTER IS LOCKED

Your PC is locked due to activity involving viewing, copying and
distribution of video materials containing pornography, physical and sexual
abuse of children. You have to pay the fine of 600000 Belarusian rubbles to
remove the lock. Use any valid Webmoney terminals to deposit the money to
B208016071489. Unlock code will be displayed at the end of the transaction.
Enter the code at the bottom of the screen and press "Enter". Once the lock
is removed you have to delete all of the offending materials. If the fine
is not paid within 12 hours all of the data on your PC will be permanently
deleted and your case forwarded to court for investigation as per article
343 part 1 of Criminal Code of Republic of Belarus.

A T T E N T I O N !

If you attempt to reboot or shutdown the PC all the data on it will be
permanently deleted including OS code and BIOS.


Article 343.1. Production and distribution of pornographic materials of
items.

Production or possession with an intend of distribution or advertisement,
or distribution or advertisement of pornographic materials including
magazines or other items of pornographic characteristics containing images
of the minors, or public demonstration of pornographic movies of videos
containing the same images - subjected to community work term up to 2
years, or an arrest term up to 6 months, or a jail term up to 4 years.

Note for reverse engineer:

download file now

Comments

Post a Comment

Popular posts from this blog

Top 3 Custom Contact Us Form Widgets for Blogger

Image
Top 3 Custom Contact Us Form Widgets for Blogger Adding Contact Form 1. Log in to Blogger dashboard than go to "Layout" > "Add Widget". 2. Click on "More Widget" below "Basic" Tab on left Side. 3. Add "Contact Form" Widget Hiding Contact Form from Slidebar 1. Go to "Theme" click on "Edit HTML". 2. Click Anywhere & Press "CTRL + F" from "Keyboard" and a Search Box Will be Opened. 3. Paste the Below Code to Find it 4. Paste the Below Code Just Above the Tag (You Search in Last Step) #ContactForm1{display: none !important;} 5. Then Click on "Save Template" Adding Custom Contact Form 1. Go to "Pages" create a new page by click "New Page" 2. Give it any Title you like i.e "Contact Us" or "Contact" etc 3. Click on the "Options" from Right Sidebar & click on "Dont Allow" and "Done" 4. Now, Below there are 3 Custom ...
Read more

Redshift challenge in Seyferts Sextet

Image
Redshift challenge in Seyferts Sextet Seyferts Sextet image NOAO The National Optical Astronomy Observatory (NOAO)  site tells about the image: "This picture was taken at the Kitt Peak National Observatory s 2.1-meter telescope in July of 1998, as part of the KPNO Research Experiences for Undergraduates program, sponsored by the National Science Foundation . North is up, east is to the left." The accompanying image shows labeling and redshifts expressed in speeds km/s. While most redshifts in the sextet are in the range 4017 km/s - 4482 km/s there is one odd galaxy in the center with the speed of 19813 km/s. This is another story, altogether. Image NOAO Always ready for new adventures in Science, arent we! "Five of the members show very similar redshifts, from 4000 to 4500 km/s, while the fifth is measured at nearly 20000 km/s. Conventional wisdom argues that this is a chance projection of a distant background galaxy: some would have otherwise and require a complete reth...
Read more

Yet another ransomware variant

Image
Yet another ransomware variant The blog post of today is a bit different than usual, as you can read the full post on the Panda Security blog. Read it here: Yet another ransomware variant In this post Im simply adding some additional information and repeating the most important points. So, theres yet another ransomware variant on the loose. You may call this one Chuingam (chewing gum?) ransomware or Xwin ransomware - pointing to respectively the file with this string Chuingam dropped, or in the latter case the folder on C: it creates. Or just another (skiddie) Generic Ransomware. In the blog post above, I discuss the methodology to encrypt files it uses and how it creates your own personal key, as well as the ransom message and how to recover files (if youre lucky & fast enough). pgp.exe (PGP) is used to generate the public RSA key. Since pgp.exe requires the RAR password, this is temporarily stored in the file "filepas.tmp" - which is overwritten and deleted, so no c...
Read more