Trojan.Ransom (flash_player.exe)

[Guest Xylitol]

From crank69: http://forums.malwarebytes.org/index.php?s...st&p=362259

This trojan blocker ( MD5: 2aa7a8655507885237094b84f69c81fe ) prevents all software execution.

To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

Number to Call: 8-903-452-26-2600 ~ 8903452262600

Code to unlock Windows: 16342131

Run MBAM, to remove the infection.

This ransomware was know on the past, with a wierd GUI (18 August 2k10)

Note for reverse engineers: upx + a lame custom packer in vb

the rest is crap, registry key in \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

So this one normally appear also in safe mode.