About “Ransom.JSWorm” infection

The Ransom.JSWorm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.JSWorm virus can do?

• A process created a hidden window
• Drops a binary and executes it
• Uses Windows utilities for basic functionality
• Attempts to delete volume shadow copies
• Attempts to stop active services
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Modifies boot configuration settings
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Clears Windows events or logs
• Creates a copy of itself
• Uses suspicious command line tools or Windows utilities

How to determine Ransom.JSWorm?

File Info:
crc32: 8014B693
md5: 31adc85947ddef5ce19c401d040aee82
name: 31ADC85947DDEF5CE19C401D040AEE82.mlw
sha1: 83fc6eb67db184d72c7f869a4798276add1b6932
sha256: 40753596e42b5d9114e00d959b96f76d3575f6624a85b4d4e68a4f1d2c037389
sha512: ae4e03abbdb4a5b9b8bdc935879d74b7143fa2f46458848eb4c2581180a4b3b1ccba1f1c99a3c12be66be9eaafcc942fcb75902abb6af220017e890466dd2f75
ssdeep: 1536:hMpzUI6GFG0ulaQcxbKeBDWouUitkXtoDiarKl:hMVOG8qb57HHar
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ransom.JSWorm also known as:

How to remove Ransom.JSWorm?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.