Trojan.Ransom (video098652.exe)

This trojan blocker ( MD5: 6838cb7a415f54bc30d7aab3b4df1515 ) prevents all software execution.

To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

According to VirusTotal, the sample is detected by just one Antivirus  ~ http://www.virustotal.com/file-scan/report.html?id=92da0ae762287ea3794e72f0528ae31e15c84d43ad9f7fb20e6d02dd4ed6fd91-1300048022

Number to Call: 9095920159

Number to Call: 9602454621

Number to Call: 9643656188

Number to Call: 9602454760

Number to Call: 9643664190

Number to Call: 9602696514

Number to Call: 9643681180

Number to Call: 9643656205

Number to Call: 9602455297

Number to Call: 9643656229

Code to unlock Windows: 321654

This ransomware come from fake porn site who look like:

This ransomware was also noticed here (18 Aug 2k10) ~ here (17 Dec 2k10) ~ here (27 Dec 2k10) ~ here (12 Jan 2k11) ~ here (14 Jan 2k11) ~ here (21 Jan 2k11) ~ here (23 Jan 2k11) ~ here (1 Feb 2k11) ~ here (3 Feb 2k11) ~ here (4 Feb 2k11) ~ here (4 Feb 2k11) ~ here (5 Feb 2k11) ~ here (7 Feb 2k11) ~ here (10 Feb 2k11) ~ here (12 Feb 2k11) ~ here (27 Feb 2k11) ~ here (10 Mar 2k11)

If you have a trouble for typing the serial please follow this