MSIL/LockScreen [Threat Name] go to Threat

MSIL/LockScreen.EC [Threat Variant Name]

Category trojan
Size 1885 kB
Detection created Apr 12, 2013
Detection database version 8222
Short description

MSIL/LockScreen.EC is a trojan that blocks access to the Windows operating system.

Installation

The trojan does not create any copies of itself.

Payload information

After a certain time delay, the trojan blocks access to operating system.


To regain access to the operating system the user is requested to comply with given conditions in exchange for a password/instructions.


The trojan displays the following fake dialog boxes:

Some examples follow.

The password to regain access to the operating system is one of the following:

  • 7838408274
Other information

The trojan may delete files stored in the following folders:

  • C:\­Windows\­Temp\­
  • C:\­Documents and Settings\­%username%\­Local Settings\­Temp\­
  • C:\­Documents and Settings\­%username%\­Local Settings\­Temporary Internet Files\­
  • C:\­Users\­%username%\­AppData\­Local\­Temp\­
  • C:\­Users\­%username%\­AppData\­Local\­Microsoft\­Windows\­Temporary Internet Files\­
  • %cache%
  • %cookies%
  • %history%
  • %recent%

The trojan may create the following files:

  • %mydocuments%\­activation.txt

Trojan requires the Microsoft .NET Framework to run.

Please enable Javascript to ensure correct displaying of this content and refresh this page.