Ransom.Cryptopay.2 removal tips

The Ransom.Cryptopay.2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Cryptopay.2 virus can do?

Unconventionial language used in binary resources: Serbian (Cyrillic)
The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Ransom.Cryptopay.2?


File Info:
crc32: AA0376AB
md5: 4451a3e53ce19e97042aa2077163497d
name: 4451A3E53CE19E97042AA2077163497D.mlw
sha1: 84a528915b88eeb6a3215f08077e421a19bfa06f
sha256: 23c170c31a7a54c5036a0ada462399bdbbc824d60f5596ef7184d5f5f891ac8b
sha512: ab7785d8ec4c1b6689adbaed9710cdeb40ea381b431857e13043a849173e946960f638f30702620b628ab2f27d9f723bfb73c09207d15b3d95441f0bbb733b53
ssdeep: 49152:1rHw1zV7MCWKrnaagCoZkfnu/b53dyizuNru/2SREz1ODl2z5m32UwofQgdiBdNz:9Pc4N7Wm3o6NekkOAP0rezdxhvq8l/H
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright Opera Software 2018
InternalName: Opera
FileVersion: 51.0.2830.55
CompanyName: Opera Software
ProductName: Opera auto-updater
ProductVersion: 51.0.2830.55
FileDescription: Opera auto-updater
Translation: 0x0409 0x04b0

Ransom.Cryptopay.2 also known as:

ALYac	Gen:Variant.Ransom.Cryptopay.2
Cybereason	malicious.53ce19
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.IESKDZC
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Ransom.Cryptopay.2
MicroWorld-eScan	Gen:Variant.Ransom.Cryptopay.2
Ad-Aware	Gen:Variant.Ransom.Cryptopay.2
Sophos	Mal/Generic-S
Comodo	Malware@#3b15k0nnn02e9
BitDefenderTheta	Gen:NN.ZexaF.34294.qF1@a83M5BvP
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis
FireEye	Gen:Variant.Ransom.Cryptopay.2
Emsisoft	Gen:Variant.Ransom.Cryptopay.2 (B)
Avira	TR/Crypt.XPACK.Gen3
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Ransom.Cryptopay.2
McAfee	Artemis!4451A3E53CE1
MAX	malware (ai score=96)
Ikarus	Trojan.SuspectCRC
Fortinet	W32/Generik.IESKDZC!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ransom.Cryptopay.2?

Ransom.Cryptopay.2 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X