Ransom

Generic.Ransom.BTCWare.6CDAF85D removal tips

Malware Removal

The Generic.Ransom.BTCWare.6CDAF85D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generic.Ransom.BTCWare.6CDAF85D virus can do?

  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Attempts to delete volume shadow copies
  • Modifies boot configuration settings
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Writes a potential ransom message to disk
  • Network activity detected but not expressed in API logs
  • Likely virus infection of existing system binary
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Generic.Ransom.BTCWare.6CDAF85D?


File Info:

crc32: 63C0004A
md5: a9d56b642b4a973b65f0b2f93780d13e
name: A9D56B642B4A973B65F0B2F93780D13E.mlw
sha1: a8d807f3aa7d6d6dcc82b6a9e2f3056737e21ffd
sha256: 7c19bc3a4ad7cddcd78eee053b408779c25a56c9666e9cc9d76ea617aaa0934d
sha512: 077139780d726469915da67556af5f829c6463d2d7aaf3c998eb70310f27416301926f61c4732b5fd7a6003148811967df9e1b5cef4ba2cdde3aa3a34d2cb53f
ssdeep: 3072:KjjJ2YYP0ueXNT/CPFhaLUNbT/VWjfEkgS5y19jVjlKzQq+vh:Kv77XNT/CmANn9OckgSO9xjwUh
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Generic.Ransom.BTCWare.6CDAF85D also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 0050b0f71 )
LionicTrojan.Win32.Scatter.j!c
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.10707
ClamAVWin.Ransomware.BTCWare-6329927-0
CAT-QuickHealTrojan.MauvaiseRI.S5248948
ALYacTrojan.Ransom.BTCWare
ZillyaTrojan.Filecoder.Win32.5945
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
K7GWTrojan ( 0050b0f71 )
Cybereasonmalicious.42b4a9
SymantecRansom.Locky
ESET-NOD32Win32/Filecoder.BTCWare.E
APEXMalicious
AvastWin32:Malware-gen
CynetMalicious (score: 100)
KasperskyTrojan-Ransom.Win32.Cryptor.anh
BitDefenderGeneric.Ransom.BTCWare.6CDAF85D
NANO-AntivirusTrojan.Win32.Agent.epfoht
ViRobotTrojan.Win32.S.Ransom.113664
MicroWorld-eScanGeneric.Ransom.BTCWare.6CDAF85D
TencentTrojan.Win32.BTCWare.a
Ad-AwareGeneric.Ransom.BTCWare.6CDAF85D
SophosMal/Generic-R + Troj/Btcware-A
ComodoMalware@#39f8744qjv4kc
BitDefenderThetaAI:Packer.6F03C8EC1E
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_BTCWARE.G
McAfee-GW-EditionBehavesLike.Win32.Generic.cc
FireEyeGeneric.mg.a9d56b642b4a973b
EmsisoftGeneric.Ransom.BTCWare.6CDAF85D (B)
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1122952
Antiy-AVLTrojan/Generic.ASMalwS.21A51F4
MicrosoftRansom:Win32/Betisrypt!rfn
ArcabitGeneric.Ransom.BTCWare.6CDAF85D
GDataWin32.Trojan-Ransom.BTCWare.F
TACHYONRansom/W32.Cryptor.235520
AhnLab-V3Trojan/Win32.Scatter.C1976243
McAfeeArtemis!A9D56B642B4A
MAXmalware (ai score=100)
VBA32BScope.Trojan.Agentb
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom_BTCWARE.G
YandexTrojan.GenAsa!avPO/XVNMxQ
IkarusTrojan-Ransom.BTCWare
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Generic.AP.DD9B4!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.Cryptor.HwsB2V8A

How to remove Generic.Ransom.BTCWare.6CDAF85D?

Generic.Ransom.BTCWare.6CDAF85D removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment