{
  "family": "pornoblocker",
  "sample_count": 11,
  "category": "ransomware",
  "description": "Ransomware:Win32/Pornoblocker (often categorized generically as a **Winlocker** or Screenlocker) represents a classic, historical evolutionary step in ransomware. Prominent in the late 2000s and early 2010s, this malware did *not* encrypt files. Instead, it aggressively locked the user's desktop interface, displaying a full-screen, highly embarrassing image (often pornographic or claiming to be from law enforcement regarding illegal pornography), and demanded a fine (often via SMS or prepaid cards) to unlock the machine.<br><br><b>Understanding Pornoblocker (Winlocker)</b><br>To a victim, a Pornoblocker infection was an immediate, panic-inducing event. The computer became entirely unusable; the screen was locked, the keyboard was often disabled, and Task Manager was blocked. The social engineering relied entirely on shame and fear. For a security analyst, these early screenlockers were relatively simplistic. Because they didn't utilize complex cryptography, the data was never actually lost, just rendered temporarily inaccessible by aggressive UI manipulation.<br><br><b>Execution and Screen Locking Mechanics</b><br>Pornoblocker was typically distributed via drive-by downloads on illicit websites or peer-to-peer networks (`T1189`). Upon execution, the malware established persistence, often by modifying the critical `Shell` value in the Registry (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon`). Instead of launching `explorer.exe` (the normal Windows desktop), Windows would launch the malware executable at boot (`T1547.004`). The malware created a full-screen, always-on-top window (`T1491`), aggressively killed `taskmgr.exe` if the user tried to open it, and hooked the keyboard (`T1056.001`) to block `Alt+Tab` or `Ctrl+Alt+Del`. The screen displayed the ransom demand, forcing the user to pay to remove the lock.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was extreme disruption of use and psychological distress/extortion, but no actual data destruction. Detection was obvious due to the locked screen. Incident responders would boot the machine into Safe Mode (which often bypassed the modified Winlogon Shell registry key) or use offline registry editors to identify the unauthorized executable set to launch in place of `explorer.exe`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491",
    "T1547.004",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement (Screenlocking / UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell Modification)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing Task Manager)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Do not pay the ransom; the data is not encrypted, and paying the 'fine' rarely results in the screen unlocking.",
    "Reboot the infected machine into Windows Safe Mode with Command Prompt. This often bypasses the malware's autostart mechanism.",
    "Open the Registry Editor (`regedit`) and navigate to `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon`. Change the `Shell` value back to `explorer.exe`.",
    "Locate and delete the malicious executable that was previously listed in the Shell registry key."
  ],
  "what_to_avoid": [
    "Do not reformat the hard drive unnecessarily; the files are perfectly safe and accessible once the registry key is fixed.",
    "Avoid paying via SMS or prepaid cards, as this directly funds the cybercriminal operation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}