Trump Locker Ransomware

It seems that some cyber criminals find it hilarious to name their malware after well-known people — real and fictional. The developers of Trump Locker Ransomware seized the opportunity to include Donald Trump’s last name. While Donald Trump is not interested in hacking your computer, the developers of this ransomware certainly are, so you ought to remove Trump Locker Ransomware from your PC. This malicious program was set to encrypt your personal files and then demand that you pay a ransom to get your files back. However, you cannot trust the criminals to give you the decryption key once you have paid.

We have found that this ransomware is similar to VenusLocker Ransomware. We think that this new ransomware is a clone of VenusLocker Ransomware. However, it might not come from the same developers. In any case, this is an indication that more clones may come out shortly and the only way to really protect your PC is to get an anti-malware program that can protect your PC in real time.

Now, as far as this ransomware’s dissemination methods are concerned, there is no concrete information about how it is distributed. We think cyber criminals might distribute in a way that is similar to VenusLocker Ransomware. We think that Trump Locker Ransomware’s developers have probably set up an email server that is dedicated to spamming the inboxes of unwary users with fake invoices, receipts, tax return forms, and so on in an attempt to infect as many computers as possible. The emails should feature an attached file that can be an executable disguised as a Word or PDF document. The executable can download the main executable and drop it in a secret location.

Our research has shown that Trump Locker Ransomware uses the RSA-4096 encryption and AES encryption algorithms to encrypt your files. It appends the files with the .TheTrumpLockerp extension that indicates that the file has been encrypted. This ransomware is set to fully encrypt one set of file formats and partially encrypt others. For example, it can fully encrypt the .txt, .ini, .php, .html, .css, .py, and .docx, file formats but only partially encrypt .asf, .pdf, .xls, .xlsx, .mp3, .waw, .jpg, .jpeg, and so on. This ransomware generates a unique encryption and decryption key. The encryption key is stored locally while the decryption key is sent to the command and control server. This ransomware claims that it will delete the decryption key after 72 hours of the infection is you do not pay.

Our analysis of this infection has shown that Trump Locker Ransomware drops a file named RansomNote.exe that autostarts with Windows. It is dropped on the desktop and so is What happen to my files.txt. Furthermore, it drops a file named uinf.uinf in %Temp%. However, the main executable could be stored in your Downloads folder or placed in a hidden location. Furthermore, the main executable can be named randomly, so it may be difficult to locate and identify.

As you can see, Trump Locker Ransomware is a highly malicious computer infection that can encrypt your files with a strong encryption algorithm and demand money for the decryption key. You should not comply with the demands of the criminals and remove this ransomware using our guide. We suggest using SpyHunter to detect all of the malicious files, including the main executable, and then delete them manually.

Removal Guide

1. Go to http://www.anti-spyware-101.com/download-sph
2. Download SpyHunter-Installer.exe
3. Run the Installation Wizard.
4. Launch the program.
5. Select Scan Computer Now! And let is scan the PC.
6. Then, simultaneously hold down Windows+E keys.
7. Enter the file path of the malicious files in the File Explorer’s address box and press Enter.
8. Right-click the malicious files and click Delete.
9. Then, enter %Temp% in the File Explorer’s address box and hit Enter.
10. Find uinf.uinf and delete it.
11. Then, go to the desktop and delete RansomNote.exe and What happen to my files.txt
12. Empty the Recycle Bin.

Delete the registry key

1. Press Widows+R keys.
2. Type regedit and click OK.
3. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
4. Locate TheTrumpLocker
5. Right-click it and click Delete.