MemScan:Trojan.Ransom.BPY removal guide

The MemScan:Trojan.Ransom.BPY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MemScan:Trojan.Ransom.BPY virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
A process created a hidden window
Creates an excessive number of UDP connection attempts to external IP addresses
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Exhibits behavior characteristic of Cerber ransomware
Attempts to execute a binary from a dead or sinkholed URL
Writes a potential ransom message to disk
EternalBlue behavior
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Generates some ICMP traffic
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

api.blockcypher.com

btc.blockr.io

bitaps.com

chain.so

ocsp.digicert.com

p27dokhpz2n7nvgr.1j9r76.top

How to determine MemScan:Trojan.Ransom.BPY?


File Info:
crc32: 23AB3028
md5: 7629f67db8d1a267fbaa1a31b01047e5
name: 7629F67DB8D1A267FBAA1A31B01047E5.mlw
sha1: 627abc39916cd5700bd605f7836a334f0cb13856
sha256: d248ee6805b6addef7af366babd1e5d0d39838da719541c8af765cd47fbe0732
sha512: b5b1efc12940ad8fe0137ecfc11bedfec028622bb05a9ec1e977b7dc826a59a980ad3f5ab4b78a045678c087f31f2f48e55f20af0ce874af1005b4aef93192f2
ssdeep: 6144:GFShGxWdsFBjK0wbNEZex5dMsV+Fl/viNRu:GFuGasFBmhREseselviru
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

MemScan:Trojan.Ransom.BPY also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Riskware ( 0040eff71 )
Lionic	Trojan.Win32.MemScan.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.11198
Cynet	Malicious (score: 100)
ALYac	MemScan:Trojan.Ransom.BPY
Zillya	Trojan.Zerber.Win32.4446
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.db8d1a
Cyren	W32/Zbot.AW.gen!Eldorado
ESET-NOD32	a variant of Win32/GenKryptik.DASN
Zoner	Probably Heur.ExeHeaderH
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Zerber.foea
BitDefender	MemScan:Trojan.Ransom.BPY
NANO-Antivirus	Trojan.Win32.Zerber.eopuww
MicroWorld-eScan	MemScan:Trojan.Ransom.BPY
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	MemScan:Trojan.Ransom.BPY
Sophos	Mal/Generic-S + Mal/EncPk-AOP
Comodo	Malware@#3s9tjp7qk14z2
BitDefenderTheta	Gen:NN.ZexaF.34170.omW@aSwOr6ei
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.7629f67db8d1a267
Emsisoft	MemScan:Trojan.Ransom.BPY (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Crypt.XPACK.Gen
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.2ABFD0C
Microsoft	Ransom:Win32/Cerber.K
GData	MemScan:Trojan.Ransom.BPY
AhnLab-V3	Malware/Win32.Generic.C3088169
Acronis	suspicious
McAfee	Artemis!7629F67DB8D1
MAX	malware (ai score=82)
VBA32	BScope.Trojan.Encoder
Panda	Trj/CI.A
Rising	Trojan.Generic@ML.99 (RDML:Y1OxieMo4H8yRqmhbjBxWw)
Yandex	Trojan.Zerber!RwK/hwkFfUc
Ikarus	Trojan.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.FSHI!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove MemScan:Trojan.Ransom.BPY?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MemScan:Trojan.Ransom.BPY removal guide