Ransom.496 removal guide

The Ransom.496 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.496 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Anomalous binary characteristics

Related domains:

passnovawin7.viptop.ru

How to determine Ransom.496?


File Info:
crc32: 28847FBC
md5: 5492f2e9ff6120efb9cb0d8e355ee4b8
name: 5492F2E9FF6120EFB9CB0D8E355EE4B8.mlw
sha1: ae9ff8aa2d4427889b09c34b133ba94eb6027db9
sha256: 12c47d2a3e92b8f7e50137bf04c191a32c26bceb74ba0568d843b0d7dc831cee
sha512: 7f08c4a9d9e6be6ef7688b55bac4e228d318d641453dbdbcc0605a3a6d2c4fc56baa6962001d5db8bfd271349fd3cbe15ad18a408b11decd2ac5af073289ed15
ssdeep: 192:mhI6QpCwbmhFLV+CtPL2xithu8lM6XsgOIqgBJtRop:aIvbmbp+CBKmu8lMPIqgBJE
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2011
Assembly Version: 1.0.0.0
InternalName: DPAPI.exe
FileVersion: 1.0.0.0
ProductName: DPAPI
ProductVersion: 1.0.0.0
FileDescription: DPAPI
OriginalFilename: DPAPI.exe

Ransom.496 also known as:

K7AntiVirus	Trojan ( 005713671 )
Lionic	Trojan.Multi.Generic.4!c
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Ransom.496
Cylance	Unsafe
Sangfor	Trojan.Win32.Agent.8
K7GW	Trojan ( 005713671 )
Cybereason	malicious.9ff612
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/PSW.Agent.OIO
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Ransom.496
NANO-Antivirus	Trojan.Win32.Kazy.dxitpk
MicroWorld-eScan	Gen:Variant.Ransom.496
Tencent	Win32.Trojan.Kazy.Svre
Ad-Aware	Gen:Variant.Ransom.496
Sophos	Mal/Generic-S
Comodo	Malware@#1u19rkcym0ez6
BitDefenderTheta	Gen:NN.ZemsilF.34050.am0@auA@7Bp
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.5492f2e9ff6120ef
Emsisoft	Gen:Variant.Ransom.496 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1131335
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Backdoor:Win32/Bladabindi!ml
Arcabit	Trojan.Ransom.496
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Ransom.496
McAfee	Artemis!5492F2E9FF61
MAX	malware (ai score=100)
Yandex	Trojan.PWS.Agent!2IFdqJ7Tfgc
Ikarus	Trojan.MSIL.PSW
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.OIO!tr.pws
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ransom.496?

Ransom.496 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X