Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Ransom
Threat report

Ransom.InfoDot.1 (B) removal instruction

Published Apr 23, 2024 Ransom category 2 min read
Report context

What to verify before removal

Ransom.InfoDot.1 (B) removal instruction should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.

Start by comparing the local file name with 9FA262ED7E967B539D38.mlw, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
9FA262ED7E967B539D38.mlw
  • Compare the suspicious file name with 9FA262ED7E967B539D38.mlw.
  • Confirm the detection name matches Ransom.InfoDot.1 (B) removal instruction before removing related files.
  • Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
  • Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.

The Ransom.InfoDot.1 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Ransom.InfoDot.1 (B) virus can do?

  • Sample contains Overlay data
  • Uses Windows utilities for basic functionality
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid
  • Uses Windows utilities to create a scheduled task
  • CAPE detected the shellcode get eip malware family
  • Uses suspicious command line tools or Windows utilities
  • Uses XCOPY for copying files
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.InfoDot.1 (B)?



File Info:

name: 9FA262ED7E967B539D38.mlw
path: /opt/CAPEv2/storage/binaries/21d27cb4cd56b67a833e6aad72fd02c1e760fc300f7995f7a07cd54ccd783ef9
crc32: 20553F12
md5: 9fa262ed7e967b539d38cb4d7ce81154
sha1: 2a776cecc638f4bb1d2566422f9a66fd1f372ac8
sha256: 21d27cb4cd56b67a833e6aad72fd02c1e760fc300f7995f7a07cd54ccd783ef9
sha512: 4ee8cbf73f2898a2857ecb48a359816ac23d45c8560eba1545c3fd7499f746733d03bf671973d94ee78eb2d80025c38b981f041d5042fcc26490cd8ea8a6accf
ssdeep: 49152:RnApg5ivlY4sn/eQC4JvYKRI8pOKBci7F8VSmEmnivsqEE5iPuZAZXJ7M:Rx5nJnVJ7OKBLZUMzEE5iWZc7M
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10AB533E0A5C0D031D50B6E76DDC96776AAF8B03437D44A0BBBC11F592A20AF6CB16763
sha3_384: 5f83753303e6bfa87a6aa10a858f31e6e4186ee30b0f1ed7ac17dbcc194c181fefedfc49e4446fc11c3b907bf2162f9a
ep_bytes: e8f0570000e978feffff8bff558bec56
timestamp: 2013-08-22 13:00:50


Version Info:

0: [No Data]

Ransom.InfoDot.1 (B) also known as:

Bkav W32.AIDetectMalware
MicroWorld-eScan Gen:Variant.Ransom.InfoDot.1
FireEye Gen:Variant.Ransom.InfoDot.1
Skyhigh BehavesLike.Win32.Dropper.vc
McAfee Artemis!9FA262ED7E96
Cylance unsafe
VIPRE Gen:Variant.Ransom.InfoDot.1
Sangfor Trojan.Win32.Agent.Vv0b
APEX Malicious
BitDefender Gen:Variant.Ransom.InfoDot.1
Emsisoft Gen:Variant.Ransom.InfoDot.1 (B)
Trapmine malicious.high.ml.score
Arcabit Trojan.Ransom.InfoDot.1
GData Gen:Variant.Ransom.InfoDot.1
ALYac Gen:Variant.Ransom.InfoDot.1
MAX malware (ai score=83)
Fortinet Malicious_Behavior.SB
DeepInstinct MALICIOUS
alibabacloud RansomWare:Win/InfoDot

How to remove Ransom.InfoDot.1 (B)?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.