

Type your Administrator password and press Enter.Type the number that corresponds to the drive and folder that contains Windows (usually C:\WINDOWS) and press Enter.( Note for Windows 2000: After pressing r, type c to choose the Recovery Console on the repair options screen.) On the Main Menu, type r to enter the Recovery Console.When prompted, press any key to boot from the CD.Insert your Windows Installation CD into your CD drive then restart your computer.To restore your system's Master Boot Record (MBR): When a key is pressed, the following ransom note is displayed: Once the machine is restarted, the following message is displayed on the user's screen: It then restarts the system effectively executing its routines. It modifies the boot sector of the affected system to automatically load itself. This Trojan encrypts files with the following extensions: %UserProfile%\Application Data\\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.).

This Trojan drops the following copies of itself into the affected system and executes them: This Trojan may be dropped by the following malware:
