Trojan:Win32/LockScreen.AO is a trojan that gains control of the affected computer by locking the screen and preventing the user from accessing the desktop. It forces the user to send an SMS to a premium number to regain access to the computer.
Trojan:Win32/LockScreen.AO modifies the registry to always run itself during system startup:
In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "Shell"
With subkey: "<malware file>"
Locks the user out of the computer
Trojan:Win32/LockScreen.AO locks the computer and prevents the user from accessing the desktop until the user enters a code. The code can be obtained by sending an SMS to a premium number.
When installed, Trojan:Win32/LockScreen.AO displays the following message:
Analysis by Jireh Sanico
The following system changes may indicate the presence of this malware: