Ransom

About “Ransom:MSIL/ThanosCrypt.PA!MTB” infection

Malware Removal

The Ransom:MSIL/ThanosCrypt.PA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:MSIL/ThanosCrypt.PA!MTB virus can do?

    How to determine Ransom:MSIL/ThanosCrypt.PA!MTB?

    

    File Info:
    
crc32: B7EFE135
    md5: fcdde462418490d11efb7c31a139536f
    name: FCDDE462418490D11EFB7C31A139536F.mlw
    sha1: 43fffb2405e8b400b4b92e5f3b8063e91881ee4f
    sha256: 72a4953d71e007465eb75380ac11cef424111ac11ab5a8e691197a561d141756
    sha512: 950887329df821f6c9dfcb1760c82eb626631e0ee21929a929099389e20f43e522b55025cdcc36497f933cf6216d14d1022a0304bf5fa2a09d522bfd40e0305c
    ssdeep: 3072:NyZrNiHXqorbvkAgBkLDd1u939jIELxcd59brJ4FCese67CG5qA:/SN059bx1nq
    type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
    

    Version Info:
    
Translation: 0x0000 0x04b0
    LegalCopyright:  
    Assembly Version: 0.0.0.0
    InternalName: worldvide.exe
    FileVersion: 0.0.0.0
    ProductVersion: 0.0.0.0
    FileDescription:  
    OriginalFilename: worldvide.exe

    Ransom:MSIL/ThanosCrypt.PA!MTB also known as:

    K7AntiVirusTrojan ( 005689411 )
    Elasticmalicious (high confidence)
    DrWebTrojan.EncoderNET.31368
    CynetMalicious (score: 100)
    CAT-QuickHealTrojan.Generic
    ALYacTrojan.Ransom.Thanos
    CylanceUnsafe
    SangforTrojan.Win32.Save.a
    CrowdStrikewin/malicious_confidence_100% (W)
    AlibabaRansom:MSIL/ThanosCrypt.62f5b771
    K7GWTrojan ( 005689411 )
    Cybereasonmalicious.241849
    CyrenW32/Azorult.D.gen!Eldorado
    SymantecML.Attribute.HighConfidence
    ESET-NOD32a variant of MSIL/Filecoder.Thanos.A
    APEXMalicious
    AvastWin32:RansomX-gen [Ransom]
    KasperskyHEUR:Trojan-Ransom.MSIL.Crypren.gen
    BitDefenderGen:Variant.Razy.836458
    NANO-AntivirusTrojan.Win32.Ransom.iniiqu
    ViRobotTrojan.Win32.Z.Razy.122368.DY
    MicroWorld-eScanGen:Variant.Razy.836458
    Ad-AwareGen:Variant.Razy.836458
    SophosMal/Generic-S + Mal/Hakbit-A
    BitDefenderThetaGen:NN.ZemsilF.34628.hm0@aCMNdMi
    TrendMicroRansom.MSIL.THANOS.SM
    McAfee-GW-EditionBehavesLike.Win32.Generic.cm
    FireEyeGeneric.mg.fcdde462418490d1
    EmsisoftGen:Variant.Razy.836458 (B)
    SentinelOneStatic AI – Malicious PE
    AviraHEUR/AGEN.1121269
    MicrosoftRansom:MSIL/ThanosCrypt.PA!MTB
    AegisLabTrojan.MSIL.Crypren.j!c
    GDataGen:Variant.Razy.836458
    AhnLab-V3Malware/Gen.RL_Reputation.C4315945
    McAfeeRansom-Thanos!FCDDE4624184
    MAXmalware (ai score=83)
    VBA32TScope.Trojan.MSIL
    MalwarebytesMalware.AI.3844476070
    PandaTrj/GdSda.A
    TrendMicro-HouseCallRansom.MSIL.THANOS.SM
    RisingTrojan.AntiVM!1.CF63 (CLOUD)
    IkarusTrojan.MSIL.Injector
    MaxSecureTrojan.Malware.300983.susgen
    FortinetMSIL/Thanos.A!tr.ransom
    AVGWin32:RansomX-gen [Ransom]
    Paloaltogeneric.ml
    Qihoo-360Win32/Ransom.Generic.HwMAY6MA

    How to remove Ransom:MSIL/ThanosCrypt.PA!MTB?

    Ransom:MSIL/ThanosCrypt.PA!MTB removal tool
    • Download and install GridinSoft Anti-Malware.
    • Open GridinSoft Anti-Malware and perform a “Standard scan“.
    • “Move to quarantine” all items.
    • Open “Tools” tab – Press “Reset Browser Settings“.
    • Select proper browser and options – Click “Reset”.
    • Restart your computer.

    You may also like

    About the author

    Paul Valéry

    I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

    View all posts

    Leave a Comment