Should I remove “Generic.Ransom.Bitpaymer.7231A049”?

The Generic.Ransom.Bitpaymer.7231A049 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Ransom.Bitpaymer.7231A049 virus can do?

• Executable code extraction
• Creates RWX memory
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Installs itself for autorun at Windows startup
• Exhibits possible ransomware file modification behavior
• Writes a potential ransom message to disk
• Creates a hidden or system file
• Likely virus infection of existing system binary
• Creates a copy of itself
• Attempts to interact with an Alternate Data Stream (ADS)
• Creates a slightly modified copy of itself
• Appends a known Locked ransomware file extension to files that have been encrypted
• Anomalous binary characteristics

How to determine Generic.Ransom.Bitpaymer.7231A049?

File Info:
crc32: 13517691
md5: b13d654a60b2bc15115562bc6eb4b88f
name: B13D654A60B2BC15115562BC6EB4B88F.mlw
sha1: 735542c5bc12e82232a22df1e2b3860152a5c40b
sha256: 8eaded1384d909dd50aa1702cf286988680c2452f307879a0c3eddae6f36f776
sha512: 51714c0b998c264c22d96405fba8d598f6a116f1d8de93122c392b74e25057d8b2ad31b05f05d936c407008a1de8feb6ce6767b4a5d5eb7d12c99759e74189dd
ssdeep: 1536:tmArSvhVIVBXXAcYIsy+LtrewZlw/jxYJXqUdBZR67mrC+/:tmkihwBXQksdL1ewnN5R6S
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: riched32
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7601.17514
FileDescription: Wrapper Dll for Richedit 1.0
OriginalFilename: riched32.dll
Translation: 0x0409 0x04b0

Generic.Ransom.Bitpaymer.7231A049 also known as:

How to remove Generic.Ransom.Bitpaymer.7231A049?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.