Ransom.Desu information

The Ransom.Desu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Desu virus can do?

Unconventionial language used in binary resources: Chinese (Hongkong)
Installs itself for autorun at Windows startup
Writes a potential ransom message to disk

How to determine Ransom.Desu?


File Info:
crc32: 024809B5
md5: 7b1cbdf3b4b4be02344c1e947c2cebc1
name: 7B1CBDF3B4B4BE02344C1E947C2CEBC1.mlw
sha1: 6cc618f79b90214a35f96eebec2b185066d4a691
sha256: 7a9dc462e83b129cff0fd70aab330d66c5f5efa79232e2c5bd95e265d13ee6f9
sha512: 300bf79ce19153b88d802e61038dfd5b519555eeb1a979e02b9a8582c7c1536594fbc98b1afc77de992ff48673b391dfc2ca8923f911c0db5a1a26b81c6a7d2c
ssdeep: 49152:UFPQDcL5tj112jGLF2eoRdDyLI3QA8LaUAafWVsK:GHLjas
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Doctor Web, 1992-2016
InternalName: drweb-1100-win-space
FileVersion: 11.0.3.12051
CompanyName: Doctor Web, Ltd.
ProductName: Dr.Web Security Space
ProductVersion: 11.0.3.12051
FileDescription: Dr.Web Security Space
OriginalFilename: drweb-1100-win-space.exe
Translation: 0x0000 0x04b0

Ransom.Desu also known as:

K7AntiVirus	Trojan ( 0053b2771 )
Cynet	Malicious (score: 85)
ALYac	Trojan.Ransom.Aurora
Cylance	Unsafe
Zillya	Trojan.GenericKD.Win32.176803
Alibaba	Ransom:Win32/Aurora.181211
K7GW	Trojan ( 0053b2771 )
Cybereason	malicious.3b4b4b
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan-Dropper.Win32.Dorgam.xog
BitDefender	Generic.Ransom.Animus.3EDF5285
NANO-Antivirus	Trojan.Win32.Dorgam.fhnpgs
MicroWorld-eScan	Generic.Ransom.Animus.3EDF5285
Tencent	Malware.Win32.Gencirc.114d3a08
Ad-Aware	Generic.Ransom.Animus.3EDF5285
Sophos	Mal/Generic-S
Comodo	Malware@#1e951ed9h3avs
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.tm
FireEye	Generic.Ransom.Animus.3EDF5285
Emsisoft	Generic.Ransom.Animus.3EDF5285 (B)
Avira	TR/SilentSpring.uodcf
Microsoft	Trojan:Win32/Occamy.C
AegisLab	Trojan.Win32.Dorgam.b!c
GData	Generic.Ransom.Animus.3EDF5285
AhnLab-V3	Trojan/Win32.Dorgam.C2686241
McAfee	GenericRXNE-AS!7B1CBDF3B4B4
MAX	malware (ai score=100)
Malwarebytes	Ransom.Desu
Panda	Trj/GdSda.A
Rising	Ransom.Genasom!8.293 (TFE:5:KGn67o10FyE)
Yandex	Trojan.GenAsa!RN4WTw0SHHg
Fortinet	W32/SilentSpring.A!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
Qihoo-360	Win32/TrojanDropper.Generic.HgIASOQA

How to remove Ransom.Desu?

Ransom.Desu removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X