Remove Trojan.Ransomcrypt
Posted on: June 14th, 2009
| Discovered: | June 9, 2009 |
| Updated: |
June 10, 2009 3:02:08 PM |
| Type: |
Trojan |
| Systems Affected: |
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP |
| Recommended Action: | |
 In order to Remove Trojan.Ransomcrypt you need to Download the ‘No Adware’ remover software. Based on our testing this was the best peforming remover of Trojan.Ransomcrypt .. |
|
| Technical Details: |
| When the Trojan is executed, it creates the following file, which is saved as the desktop wallpaper:
%SystemDrive%\vsworkdir\shantazh.jpg It also creates the following file, which is a cryptographic library: %SystemDrive%\vsworkdir\CSCA1.DLL Next, the Trojan scans all local drives for files with the following extensions: * .doc * .jpg * .rar * .zip * .txt * .rtf * .jpeg * .html * .htm * .php * .eml * .3gp * .7z The Trojan encrypts all files that it finds and adds a .vscrypt extension. It then deletes the original file. The same password is used to encrypt all files. When the Trojan has finished encrypting all of the files, it modifies the desktop wallpaper and restarts the computer. |
| Action Steps: |
| FREE SCAN: NoAdware can Remove Trojan.Ransomcrypt. Click the link below for your free download & scan your PC now.
Please click here for manual removal instructions. |
