Troj/Ransom-A

Please follow the instructions for removing Trojans.

Troj/Ransom-A is a Trojan for the Windows platform.

When run, Troj/Ransom-A creates the file <Start Menu>\Startup\winstart.exe and this file is set as hidden. The file winstart.exe is detected as Troj/Ransom-A.

Troj/Ransom-A creates the following files:

<windows>\svchost.exe
<windows>\data3.exe
<windows>\009.exe
<windows>\008.exe
<windows>\007.exe
<windows>\006.exe
<windows>\005.exe
<windows>\004.exe
<windows>\002.exe
<System>\oobe\setup\corpstats.exe

These files are detected as Troj/Ransom-A.

Troj/Ransom-A also creates <windows>\data2.exe, <windows>\data4.exe and <windows>\dat1.bat, and these files can be safely removed.

Troj/Ransom-A sets the following registry entry:

HKLM\SOFTWARE\Windows\CurrentVersion\RunOnceEx
cleanup
<System>\oobe\setup\corpstats.exe

Troj/Ransom-A displays the following message boxes when run:

"Deleted files are going to be saved into a hidden directory and replaced during uninstallation."

"(1) files are being deleted every 30 minutes"

Troj/Ransom-A displays pornographic pictures and the following message:

environment locked
windows locked

listen up muthafucka
is this computer valuable. it better not be.
is this a business computer. it better not be.
do you keep important company records or files on this computer.you'd better hope not.
because there are files scattered all over it tucked away in
invisible hidden folders undetectable by antivirus sofware
the only way to remove them and this message is by a CIDN number

This X.aip will load everytime you start windows scattering more and more copies of iteslf until your computer is fried to a pulp. until then you may even noteice other programs missing critical files.

How to Remove it

Simple. you must receive a CIDN: number from Western Union

go to Western union, fill out the grey form labelled "SwiftPay" pay $10.99 as your customer access number enter "4 8 7 0 9 3 0 1 0 1 3 0 8 6 9 7"
you may sign any name, i.e John Doe.
and wait for a receipt from the clerk. Look on the top right-hand corner of the receipt for a number that starts with CIDN: i.e CIDN: 203-093-1903
comback to this computer an enter your CIDN number. The uninstall process will begin.

note: if you don't pay exactly $10.99 you will generate an invalid CIDN number and be forced to start all over.

If you have a valid CIDN: Number and have problems uninstalling send a reuqest to
unlock3713@yahoo.com I will research the problem and if applicable send a alternate CIDN: universal key by email.

Troj/Ransom-A spawns multiple processes of itself and when attempting to kill the process, it displays a picture and the following message:

Yeah, We don't die, We multiply!
Ctrl+Alt+Del isn't quite working today, is it? I'm not the sharpest tool in the shed but
Crtl+Alt+Del is everyone's S.O.S