Categories: Malware

MSIL/LockScreen.CQ removal instruction

The MSIL/LockScreen.CQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/LockScreen.CQ virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
The binary likely contains encrypted or compressed data.
Crashed cuckoomon during analysis. Report this error to the Github repo.
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

How to determine MSIL/LockScreen.CQ?


File Info:
crc32: A75BC759md5: 1d61b076305311717391675b31d34708name: 1D61B076305311717391675B31D34708.mlwsha1: d0febfb41726d1671aaae52a4c834a971f658994sha256: 96f020812fdebf332434d6cfd365aa36adf39f89118d2fbceb518dba42855cd3sha512: 33cdd35f32c587b285992ea2a1ecb16ea1cb82231be088f449eeeafea617e4ffd0b48ba9952a3ba36b75fa7d6e656221e48ebd122197700b0cea0de49d25ab58ssdeep: 384:Uke49okYtU7A7WxKPBan2mkHTrLO7WxKPBan2mkHTrLiSAQx2rv5d++t/EFnwib:Uny7p4Pgkzfr4Pgkzfq5/Eeqotype: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9 Microsoft 2013Assembly Version: 1.0.0.0InternalName: BehringerX32Administrator.exeFileVersion: 1.0.0.0CompanyName: MicrosoftProductName: BehringerX32AdministratorProductVersion: 1.0.0.0FileDescription: BehringerX32AdministratorOriginalFilename: BehringerX32Administrator.exe

MSIL/LockScreen.CQ also known as:

DrWeb	Trojan.Winlock.7751
Cynet	Malicious (score: 85)
ALYac	Gen:Variant.MSILPerseus.180394
Cylance	Unsafe
Zillya	Trojan.Gimemo.Win32.4825
Sangfor	Ransom.Win32.Genasom.KT
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Genasom.4ccdb91d
Cybereason	malicious.630531
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/LockScreen.CQ
APEX	Malicious
Avast	MSIL:LockScreen-M [Trj]
Kaspersky	HEUR:Trojan-Ransom.Win32.Generic
BitDefender	Gen:Variant.MSILPerseus.180394
NANO-Antivirus	Trojan.Win32.Winlock.benivn
MicroWorld-eScan	Gen:Variant.MSILPerseus.180394
Tencent	Win32.Trojan.Gimemo.ldh
Ad-Aware	Gen:Variant.MSILPerseus.180394
Comodo	Malware@#2pbdhrotbtfq1
BitDefenderTheta	Gen:NN.ZemsilF.34628.bm0@aCTKKxf
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_Genasom.R002C0DK320
McAfee-GW-Edition	Trojan-FASX!1D61B0763053
FireEye	Gen:Variant.MSILPerseus.180394
Emsisoft	Gen:Variant.MSILPerseus.180394 (B)
Avira	TR/Autorun.JR
eGambit	Generic.Malware
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Ransom:Win32/Genasom.KT
Arcabit	Trojan.MSILPerseus.D2C0AA
GData	Gen:Variant.MSILPerseus.180394
AhnLab-V3	Trojan/Win32.Gimemo.R49965
McAfee	Trojan-FASX!1D61B0763053
MAX	malware (ai score=83)
Malwarebytes	Malware.AI.3954378200
Panda	Generic Malware
TrendMicro-HouseCall	Ransom_Genasom.R002C0DK320
Rising	Ransom.Genasom!8.293 (CLOUD)
Ikarus	Trojan-Ransom.Gimemo
Fortinet	W32/Gimemo.AWNU!tr
AVG	MSIL:LockScreen-M [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Worm.AutoRun.HgIASOUA