Ransom.PureLocker.3 removal instruction

The Ransom.PureLocker.3 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.PureLocker.3 virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Ransom.PureLocker.3?


File Info:
name: F0E52DF398B938BF82D9.mlw
path: /opt/CAPEv2/storage/binaries/69f7822cac20a27c4fe955c0864a9fe9b3798f54f39ac3ebdba12b0ab4a9cdbd
crc32: 718EDC06
md5: f0e52df398b938bf82d9e71ce754ab34
sha1: b58b6e2049fbaae7eb0c7aa14564604813c9e06b
sha256: 69f7822cac20a27c4fe955c0864a9fe9b3798f54f39ac3ebdba12b0ab4a9cdbd
sha512: b72d4682fedf00d0bed68ba8840a619bb4a1d30fca4fdc5fd541d6dab66058784568b191f249aff0ba3d6be4443f5a28b383a67c1a9c3f5942fb9391bf4111b1
ssdeep: 1536:FfW5vOH39ULJGLVPphNxX3/qTikLvICS4Atihld3LO0oeV:FOxOHtuEBBB3tkLc3YLO
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1B2837C87339641F6E6D3487C867E723FE2314228CB09E4D7DB9719818AB22D6F93115E
sha3_384: 611eb9f7bb2311ccd3e2e9cb929b20aedcbf5aebcc7f0f16770092bdcc566ef7852e45325070c18dc0cc2ee9df18db91
ep_bytes: 837c24080175198b442404a3206d0110
timestamp: 2013-01-22 02:11:55

Version Info:
CompanyName: Mirinda Ltd
ProductName: Mir
ProductVersion: (c) 2016
FileVersion: 1,0,0,6
FileDescription: Mirinda
InternalName: tt
OriginalFilename: tt.dll
Translation: 0x0409 0x04b0

Ransom.PureLocker.3 also known as:

Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ransom.PureLocker.3
FireEye	Generic.mg.f0e52df398b938bf
Skyhigh	Trojan-Agent
ALYac	Trojan.Agent.88576
Zillya	Trojan.Agent.Win32.894983
Sangfor	Trojan.Win32.FIN7.IOC
K7AntiVirus	Trojan ( 00531fbd1 )
Alibaba	Trojan:Win32/Malagent.6c0e60aa
K7GW	Trojan ( 00531fbd1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Ransom.PureLocker.3
BitDefenderTheta	Gen:NN.ZedlaF.36744.fy8@auGkYjii
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Agent.ZQU
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Agent.qwgnnw
BitDefender	Gen:Variant.Ransom.PureLocker.3
NANO-Antivirus	Trojan.Win32.Graftor.fcehbf
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.114cffca
Sophos	Mal/Generic-R
F-Secure	Trojan.TR/Agent.skkkp
DrWeb	Trojan.Siggen7.54457
VIPRE	Gen:Variant.Ransom.PureLocker.3
TrendMicro	TROJ_FRS.0NA103BS22
Emsisoft	Gen:Variant.Ransom.PureLocker.3 (B)
Jiangmin	Trojan.Agent.bhes
Webroot	W32.AGent.qwgnnw
Google	Detected
Avira	TR/Agent.skkkp
MAX	malware (ai score=94)
Antiy-AVL	Trojan[APT]/Win32.Fin7
Kingsoft	malware.kb.a.973
Xcitium	Malware@#15phrbzvfuk2o
Microsoft	Trojan:Win32/Malagent
ZoneAlarm	Trojan.Win32.Agent.qwgnnw
GData	Gen:Variant.Ransom.PureLocker.3
AhnLab-V3	Malware/Win32.Generic.C2558505
McAfee	Trojan-Agent
VBA32	BScope.Trojan.Agent
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_FRS.0NA103BS22
Rising	Trojan.Agent!8.B1E (TFE:5:3WyRyKeBEAK)
Yandex	Trojan.Agent!fni87FnLDVk
Ikarus	Trojan.Win32.Agent
Fortinet	W32/Agent.ZQU!tr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove Ransom.PureLocker.3?

Ransom.PureLocker.3 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X