Daily cyber threats and internet security news: network security, online safety and latest security alerts
April 19th, 2009

System Locking SMS Ransomware Trojan.Ransomlock Can Be Removed Manually

Another ransomware threat have been reported recently by Symantec: Trojan.Ransomlock. Though not as tough as Trojan.Gpcoder (it doesn’t encrypt documents), the Trojan locks the user out of his or her desktop, so that they are unable to access the computer in any way. “Ransomware” threats became pretty familiar by now. When run, they will try and tamper with some functionality on the compromised computer, asking the user to send money to some account in order to undo the tampering. In the case of the Trojan.Gpcoder family, the main purpose of the Trojan was to heavily encrypt documents on a computer and then ask the user for money in order to receive the decryption key/tool.

When run, the Trojan displays the following window:

Notice how the design of the window attempts to mimic the Microsoft Windows interface. The text is in Russian and it says:

To unlock you need to send an SMS with the text 4113558385 to the number 3649

Enter the resulting code:

Any attempt to reinstall the system may lead to loss of important information and computer damage

The code shown is randomly generated each time. Apparently the purpose of the Trojan is to ask users to send an SMS to receive a corresponding code that will disable the Trojan, thus unlocking the computer. The attacker probably receives money for each SMS sent to the number.

Although this Trojan is not particularly dangerous, it is quite annoying. The Ctrl+Alt+Del sequence is inhibited so that a user cannot access the Task Manager to end the Trojan’s process. Rebooting will not help, even in Safe Mode, since the threat installs itself in the “Userinit” registry key so that it runs every time Windows is started.

If you get infected, be careful: don’t send any SMS messages to the number. Symantec has created a tool that you can download to generate the code needed to unlock the computer. You can also refer to the Trojan.Ransomlock write-up for more details. If you cannot download the code generator, then you will have to boot the computer with an external operating system in order to access the file system and delete the Trojan.

How to generate a valid unlock code by yourself:

1. Get the input code; it should be in the form of “411xxxxxxx.” The length of the code can be 10 or 11 digits.

2. Discard the first three digits. For example, if your code is “4111234567” then “1234567” is the number you need.

3. Convert this number to hexadecimal notation. You can do so using the Windows calculator. All of the following calculations will be in hexadecimal. In our case, “1234567” in decimal is “12D687” in hexadecimal notation.

4. Consider only the five less important digits of the hexadecimal number. We only consider “2D687.”

5. Start from the left-most digit, and apply the formula with the parameters as they appear in the disassembly:

x1 = (2 * 0×95) % 0xA7
x2 = (D * 0x6C) % 0×97
x3 = (6 * 0x1F) % 0xA3
x4 = (8 * 0x1D) % 0xB3
x5 = (7 * 0×35) % 0xC5

After this, your values should be:

x1 = 0×83, x2 = 2D, x3 = 0×17, x4 = 0×35, x5 = AE

6. Now you can use these five numbers to compose the unlock code. Perform a “left shift” operation (a multiplication by 0×10) to your values, starting from x1, and then add the result to the next number. In our example:

0×83 * 0×10 = 0×830
0×830 + 0x2D = 0x85d ;  0x85d * 0×10 = 0x85d0
0x85d0 + 0×17 = 0x85e7 ;  0x85e7 * 0×10 = 0x85e70
0x85e70 + 0×35 = 0x85EA5 ;  0x85EA5 * 0×10 = 0x85EA50
0x85EA50 + 0xAE = 0x85EAFE

7. Finally, convert this hexadecimal number back to decimal notation (in our example, you obtain “8776446”), which is the unlock code that you can use in order to get rid of the Trojan.

After you enter a valid unlock code, the malicious window will disappear, but the Windows desktop could still be frozen. Don’t worry—all you need to do is to hit Ctrl+Alt+Del on the keyboard, click on the log-off button, and then log back in. (A reboot will work as well.) At this point, you have control of the computer again and the Trojan will be gone.

Credit:  Andrea Lelli, Symantec

Share this item with others:

More on CyberInsecure:
  • New LoroBot Ransomware Encrypts Files, Demands $100 For Decryption
  • Ransomware Blocks Internet Access, Forces Users To Send Premium Rate SMS
  • New Symbian OS Malware Silently Transfers Mobiles Account Credit
  • SMS Malware Targets Symbian S60 Devices
  • New Scareware Blocks Access To Popular Websites, Demands Fake “Internet Security 2010″ To Be Installed

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: System Locking SMS Ransomware Trojan.Ransomlock Can Be Removed Manually

    6 Responses to “System Locking SMS Ransomware Trojan.Ransomlock Can Be Removed Manually”

    1. Ron Blizzard Says:
      April 27th, 2009 at 4:58 am

      I take it I have a different strain as the screen and words are the same but mine doesn’t start 411xxxxxxx, it is K2780621004, same text number.

      Can you help as your unlock tool will not decode?

    2. CyberInsecure Says:
      April 27th, 2009 at 8:56 am

      It might mean this is a different or updated version. They pop up as older version get detected.

      Try looking for a tool at Symantec, Kaspersky or PanadaSecurity websites as they might already have a solution. If not, report it to them as soon as possible.

    3. hi i have got something likje this but it seems the code that has to be smsed to 3649 is actually a 6 digit code. it has never been more than 6 digits or in the format of 41xxx….. or k2xxxx….

      i really need help. tried symantec did not find it.
      thanks. desperately waiting for the right reply.
      thank you

    4. CyberInsecure Says:
      October 7th, 2009 at 9:45 am

      You probably got the new version, it cant be removed without proper tool from anti-virus company. Try Kaspersky and Dr.Web. If their scanners didn’t fix the infection, download Rescue CDs (, one of them might help.

    5. Chris on October 7th, can you confirm that CyberInsecure’s response does in fact fix your problem. I have a friend that showed me this exact problem. Funny enough, you could easily boot into safemode or from there choose diagnostic mode through msconfig to bypass this screen. From there I knew something was wrong and illegitimate. Upon searching the web, I found this page to confirm my suspicion.

      Anyway, this gentleman also is receiving a 6 digit code to be used to unlock to the same text number that Chris has spoken about before.

      Cheer and thanks in advance,


    6. Dear Sir,

      My computer has been infected with trojan virus and when i checked my pc there was a message on my desktop saying that semi appologies and your files has been encrypted with 512 kb encryption and contact us on some email.on fear i shut down the system and run malwarebytes which removed some files.then i installed avg.9 and done full viruses detected .now the files jpg,pdf,xls files i am not able to open as these are encrypted.can you help me in unlocking thses files.
      Thank you
      Anil Kumar

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.
    Click to hear an audio file of the anti-spam word