Registry Cleaner Geeks

April 15, 2009 4:22:57 PM

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

When the Trojan executes, it creates the following file:
%Temp%\don[RANDOM CHARACTERS].tmp

The Trojan modifies the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Userinit" = "%System%\userinit.exe, %Temp%\don[RANDOM CHARACTERS].tmp"

The Trojan then displays a message in Russian, which has been translated into English below:
To unlock you need to send an SMS with the text
[RANDOM NUMBERS]
To the number
3649
Enter the resulting code:
[TEXT BOX]

Any attempt to reinstall the system may lead to loss of important information and computer damage

The Trojan attempts to lock the desktop making the computer unusable.

The threat executes every time the computer is started, even in safe mode

FREE SCAN:

MANUAL REMOVAL: Please click here for manual removal instructions.