'This PC Has Been Blocked' Screen Locker

The 'This PC Has Been Blocked' screen locker is a Trojan that imitates the Microsoft security alerts to collect ransom money from the PC's user. These attacks can stop you from using other applications or the desktop, although standard security techniques can bypass them and terminate the Trojan's window. After disabling its warning message, use anti-malware software both for removing the 'This PC Has Been Blocked' screen locker and determining whether or not its presence is the responsibility of other threats.

Turning on the Tube to Craft Trojans

The people eager to orchestrate Trojan attacks don't have a corresponding degree of programming experience or talent necessarily, which malware experts see corroborated through the repeating prominence of Ransomware-as-a-Service. Some threat actors even prefer legal video-streaming platforms like Youtube for learning how to make simple forms of threatening software like the 'This PC Has Been Blocked' screen locker. While this threat's campaign dates itself as new in March, three variants of it have been identified almost from the outset.

The 'This PC Has Been Blocked' screen locker uses still-unknown infection methods to compromise the victim's PC. With system access, its payload generates a screen-locking pop-up window with no controls, stopping the user from accessing either the desktop or other programs. The 'This PC Has Been Blocked' screen locker's author converts these attacks into profit by posing as a 'Microsoft technician' who can help you unlock your computer.

The Trojan's window is similar to the 'Blue Screen of Death' errors once prominent in Windows, although it doesn't display an error code. Instead, it includes a text stating that the PC is responsible for 'unusual activity,' such as the network traffic of a botnet Trojan. Once you input the appropriate unlocking password, the Trojan reveals its real identity as a threat.

Getting Unblocked without Paying a Price for It

As a relatively amateur effort, the 'This PC Has Been Blocked' screen locker has some vulnerabilities that malware researchers may not see with other, ransom-based threats like the Crysis Ransomware. Victims can use the Alt+F4 shortcut to close the window automatically without requiring a password. They also can use one of a set of passwords known to unlock different versions of the 'This PC Has Been Blocked' screen locker, such as 'XP8BF-F8HPF-PY6BX-K24PJ-RAA00,' '123456,' 'nvidiagpuareshit' and '30264410.'

Although this Trojan's attacks are resolvable without paying its ransom easily, it does try to disguise itself behind the legitimacy of the Microsoft brand name. Computer users should inform themselves about standard security practices so that they can identify the tactics favored by different threatening software, including these security hoaxes. Conventional anti-malware programs also may block and remove the 'This PC Has Been Blocked' screen locker by default as a threat to your computer before you see its attack.

Low-effort threats are easy to produce than professional black market products, but still threatening to your PC meaningfully. Do your part to make the 'This PC Has Been Blocked' screen locker's campaign a low-profit venture and one can hope that few clones of it will see future headlines.