Ransom

How to remove “Mal/Generic-R + Troj/Ransom-BVS”?

Malware Removal

The Mal/Generic-R + Troj/Ransom-BVS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Mal/Generic-R + Troj/Ransom-BVS virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (9 unique times)
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Looks up the external IP address
  • Uses Windows utilities for basic functionality
  • Attempts to remove evidence of file being downloaded from the Internet
  • Attempts to delete volume shadow copies
  • Exhibits behavior characteristic of Alphacrypt/Teslacrypt ransomware
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Writes a potential ransom message to disk
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Creates a known TeslaCrypt/AlphaCrypt ransomware decryption instruction / key file.
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
myexternalip.com
ocsp.pki.goog
hotbizlist.com
sofiehughesphotography.com
www.hugedomains.com
crls.pki.goog
crl.pki.goog
ocsp.digicert.com
goedkoop-weekendjeweg.net
coatesarchitecture.com
adamhughes.in
magaz.mdoy.pro
apps.identrust.com
crl.identrust.com
x1.c.lencr.org
r3.o.lencr.org

How to determine Mal/Generic-R + Troj/Ransom-BVS?


File Info:

crc32: D1A0C6D1
md5: 0eb992a376ff3ac4e51b242cec926559
name: 0EB992A376FF3AC4E51B242CEC926559.mlw
sha1: a212eb4f6d769e4c856b312bb7df3dd91a91e4da
sha256: 1bcc0dbe60f4a08c66ce873c07b55925bcc0e23c70bca231962b6a7b4a3b88cf
sha512: 7c37b7c66b4cc270270e694348e165df370f16d80a33b70f16dd1ab0510c3cb0a8b90fcd045b79fd0f702a3641298e2d0fc1ab8785e96b5e9d52909bb4c77d94
ssdeep: 6144:Gi8zAOSx+mgvGOaLw86ma676uBa9IwBja40qJE1u9DS8odfyS:GFAUmge90qsiwBax1udMz
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Mal/Generic-R + Troj/Ransom-BVS also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 004d97831 )
LionicTrojan.Win32.Bitman.j!c
Elasticmalicious (high confidence)
DrWebTrojan.Inject2.10956
CynetMalicious (score: 100)
CAT-QuickHealRansom.Crowti.B4
ALYacTrojan.Agent.BPDV
CylanceUnsafe
ZillyaTrojan.Filecoder.Win32.1533
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
AlibabaRansom:Win32/Tescrypt.16896697
K7GWTrojan ( 004d97831 )
Cybereasonmalicious.376ff3
BaiduWin32.Trojan.Kryptik.th
CyrenW32/Agent.XL.gen!Eldorado
SymantecRansom.TeslaCrypt!g2
ESET-NOD32Win32/Filecoder.TeslaCrypt.I
ZonerTrojan.Win32.37170
APEXMalicious
AvastWin32:TeslaCrypt-B [Trj]
ClamAVWin.Ransomware.TeslaCrypt-9873543-1
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.Agent.BPDV
NANO-AntivirusTrojan.Win32.Inject.dzgjuw
ViRobotTrojan.Win32.Kryptik.Gen.A
MicroWorld-eScanTrojan.Agent.BPDV
TencentMalware.Win32.Gencirc.10c5b4c0
Ad-AwareTrojan.Agent.BPDV
SophosMal/Generic-R + Troj/Ransom-BVS
BitDefenderThetaGen:NN.ZexaF.34790.vqW@aaCoJpdG
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_HPEPING.SM
McAfee-GW-EditionBehavesLike.Win32.Generic.fh
FireEyeGeneric.mg.0eb992a376ff3ac4
EmsisoftTrojan.Agent.BPDV (B)
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.Bitman.bh
WebrootW32.Trojan.Gen
AviraTR/AD.RunExp.Y.855
Antiy-AVLTrojan/Generic.ASMalwS.1614A1E
MicrosoftRansom:Win32/Tescrypt.C
ArcabitTrojan.Agent.BPDV
SUPERAntiSpywareTrojan.Agent/Gen-Ransom
GDataTrojan.Agent.BPDV
TACHYONTrojan/W32.Bitman.358912
AhnLab-V3Trojan/Win32.Teslacrypt.C1313883
Acronissuspicious
McAfeeRansomware-FBT!0EB992A376FF
MAXmalware (ai score=88)
VBA32BScope.Trojan.Inject
MalwarebytesRansom.TeslaCrypt
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_HPEPING.SM
RisingTrojan.Kryptik!1.A31F (CLASSIC)
YandexTrojan.Bitman!sh7Bu20FfAk
IkarusTrojan.Crypt
FortinetW32/Bitman.ASJ!tr
AVGWin32:TeslaCrypt-B [Trj]
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.Tescrypt.HwoCEpsA

How to remove Mal/Generic-R + Troj/Ransom-BVS?

Mal/Generic-R + Troj/Ransom-BVS removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment