[EP_X0FF]

By using partition recovery tool or entering valid password obviously.

[treehouse786]

so how do i remove this infection??

no one want to help??

[gjf]

treehouse786
Look at one post earlier ;)

[shaheen]

Does it work on windows 7? I tried in vmware player and no effects seen.

[EP_X0FF]

Allow it in UAC - and enjoy reboot :)

[shaheen]

I did so in VMware player and it rebooted just fine. :(

[EP_X0FF]

Use normal VM.

[Xylitol]

http://www.virustotal.com/file-scan/rep ... 1303174170

Code: Select all

hXXp://212.95.54.70/admin2/index.php
hXXp://212.95.54.70/locker/z.php?codeFromBootkit=

[Xylitol]

Great doc for debug MBR ransomware: http://www.hexblog.com/?p=103

[EP_X0FF]

MBRlock

Unblock code: 4011894



MBR, dropper, unpacked dropper in attach.

I'm wondering now, how these script-kiddies managed to write their own mbr code while everything else in all lockers are piece of sh*t coding example (however this does not mean that this mbr code is perfect of course).

Source hxxp://urukxxx.ru/xxxvideo.avi.exe (already down)

found alternative
hxxp://ulumbekogli.ru/xxxvideo.avi.exe