Ransom:Win32/Loktrom.B

Installation

It changes the following registry entry so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon
Sets value: "Shell"
With data: "<malware file name>"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<random name>", for example "explorer"
With data: "<malware file name>"

Payload

Prevents you from accessing your desktop

This threat displays a full-screen message that covers all other windows, rendering your PC unusable (this full-screen message is also known as a "lock screen"). It is a fake warning pretending to be from a legitimate institution which claims an association with Windows and Microsoft Security Essentials. This is untrue and is another method the trojan's authors are employing to make the threat seem legitimate.

The message states that illegal activity has been detected on your PC and that you must send a payment to a mobile phone account to regain access.

You shouldn't pay the "fine" because there is no guarantee that it will unlock your PC.

The screen might look like:

Stops processes

This threat stops the explorer.exe process by running the following command:

taskkill /F /IM explorer.exe

Analysis by Wei Li and Alden Pornasdoro