OREANDA-NEWS. On 20 April 2009 Doctor Web informed Internet users about a new Trojan that blocks access to the system and prompts the victim to send a paid SMS in order to receive a registration code to unblock it. Apparently the malicious program has been targeting only users of the Russian segment of the World Wide Web.

The Trojan is spread as a fake video codec. Once installed, it will display a message on Windows start-up informing a user that he needs to enter a registration code to unlock his system. The program was discovered on April 8 and entered the Dr.Web malware classification as Trojan.Winlock.19. The Origins TracingTM technology allows Dr.Web anti-viruses to detect new modifications of the Trojan as Trojan.Winlock.origin.

Trojan.Winlock can remove itself in two hours after launching. Users who don’t want to wait that long can use the web-form to enter the text of the suggested SMS and get the unblock code.