Ransom.10 (B) information

The Ransom.10 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.10 (B) virus can do?

Executable code extraction
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Russian
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ransom.10 (B)?


File Info:
crc32: DCAE7AF4
md5: 75bf77435316d14da5cb2b6ddae6dbcb
name: 75BF77435316D14DA5CB2B6DDAE6DBCB.mlw
sha1: 9042291415ae0fd22f2ee3c202cf87718907a336
sha256: bc2fe00b6b62cf0a20bfa0c80f46d246aab2f0807f8d4d1cfb9a60265116c076
sha512: 42eedb9e95f2a62902625a2ebf7320d2e258ecac5565f34d940ddec5c300b535b0d1b7533803280138eea288fbf687d74ddf7777fcfec01a3b17846492b22b9e
ssdeep: 384:cnuddpMCxcH7F99qX/TiIV1Dqx7onVnVmBK53uXHL0xxmW4jfA:E8dI7oFYx7int3AHUUjY
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2011 Heaventools Software
InternalName: Gsn.exe
FileVersion: 3.0.79.4
CompanyName: BitDefender
ProductName: Gusno
ProductVersion: 3.0.79.4
FileDescription: Gan
OriginalFilename: Gusn.exe
Translation: 0x004b 0x04b0

Ransom.10 (B) also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 00274f891 )
Lionic	Trojan.Win32.PornoAsset.j!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Winlock.3300
ClamAV	Win.Trojan.Pornoasset-430
ALYac	Gen:Variant.Ransom.10
Malwarebytes	Spyware.PasswordStealer.XGen
Zillya	Trojan.LockScreen.Win32.888
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	Trojan:Win32/LockScreen.35f090d2
K7GW	Trojan ( 00274f891 )
Cybereason	malicious.35316d
Cyren	W32/Ransom.O.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/LockScreen.AGD
APEX	Malicious
Avast	FileRepMetagen [Rtk]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ransom.10
NANO-Antivirus	Trojan.Win32.PornoAsset.jgmpv
MicroWorld-eScan	Gen:Variant.Ransom.10
Tencent	Win32.Trojan.Pornoasset.Aisl
Ad-Aware	Gen:Variant.Ransom.10
Sophos	Mal/Generic-S
Comodo	Malware@#3pmuup40uaw3v
BitDefenderTheta	Gen:NN.ZexaF.34796.bu0@aaw3KGec
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_KRYPTK.SM21
McAfee-GW-Edition	Generic.tra!d
FireEye	Generic.mg.75bf77435316d14d
Emsisoft	Gen:Variant.Ransom.10 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan/PornoAsset.dk
Webroot	W32.Rogue.Pornoasset.Gen
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.932039
Microsoft	Trojan:Win32/Vigorf.A
GData	Gen:Variant.Ransom.10
TACHYON	Trojan/W32.PornoAsset.24576.D
AhnLab-V3	Trojan/Win32.PornoAsset.R20667
McAfee	Generic.tra!d
MAX	malware (ai score=100)
VBA32	SScope.Malware-Cryptor.01499
Panda	Generic Malware
TrendMicro-HouseCall	TROJ_KRYPTK.SM21
Rising	Trojan.Generic@ML.95 (RDML:lEpQ63cfn1nhiMxrxJ0sNQ)
Yandex	Trojan.PornoAsset!ELa3bfd/3ZI
Ikarus	Trojan-Ransom.PornoAsset
MaxSecure	Trojan.Malware.2303722.susgen
Fortinet	W32/PornoAsset.UF!tr
AVG	FileRepMetagen [Rtk]
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.Generic.HwgAEpsA

How to remove Ransom.10 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.