After Trojan-Ransom.Win32.Blocker is installed on a computer, this Trojan adds itself to the computer’s startup routine and blocks the operating system from loading normally. When the operating system is started, Trojan-Ransom.Win32.Blocker takes control of the computer and displays a window asking the user to send an SMS message with special text to the indicated short number. In return, the window states, the user will receive a code for deactivating the malware and unlocking access to the computer.
Geographical distribution of attacks by the Trojan-Ransom.Win32.Blocker family
Geographical distribution of attacks during the period from 27 September 2014 to 27 September 2015
Top 10 countries with most attacked users (% of total attacks)
* Percentage among all unique Kaspersky users worldwide who were attacked by this malware