Ransom:Win32/GandCrab.SK!MTB removal guide

The Ransom:Win32/GandCrab.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/GandCrab.SK!MTB virus can do?

How to determine Ransom:Win32/GandCrab.SK!MTB?


File Info:
crc32: D20D2192
md5: 138148e9001855318a98c6407f12f67b
name: upload_file
sha1: b11b644da2303eac702a93b3e2454e1028b2b81c
sha256: 5e17eb054fdd11f124f33dab985b6c19453f326513f8571db2ce25f0bf52dce1
sha512: 2c67881d7081488064240e745124f6a3b1c3a219b7ef4a8f452a6bdc31eff2c56856625afff110a1b17803cf61822904ae2797fec5c9d0348c13f67a91103c52
ssdeep: 6144:jN+bbddiI9cLPigeSFkDvVR5dUv2e0kNLuuoUlxiN7s:jN+bbddH9cLPigeS+NSv2e0C6uoc
type: RAR archive data, vff,

Version Info:
0: [No Data]

Ransom:Win32/GandCrab.SK!MTB also known as:

FireEye	Trojan.GenericKD.43573714
McAfee	Artemis!138148E90018
Malwarebytes	Trojan.MalPack.DLF
Invincea	heuristic
Symantec	Trojan.Gen.NPE
TrendMicro-HouseCall	TROJ_FRS.VSNTGV20
Avast	Win32:Trojan-gen
GData	Trojan.GenericKD.43573714
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
BitDefender	Trojan.GenericKD.43573714
AegisLab	Trojan.Multi.Generic.4!c
Emsisoft	Trojan.GenericKD.43573714 (B)
F-Secure	Trojan.TR/Injector.wkgxx
DrWeb	Trojan.PWS.GrandStealNET.2
TrendMicro	TROJ_FRS.VSNTGV20
Sophos	Mal/Generic-S
Ikarus	Trojan-Dropper.Win32.Autoit
Avira	PO.exe
MAX	malware (ai score=84)
Microsoft	Ransom:Win32/GandCrab.SK!MTB
Arcabit	Trojan.Generic.D298E1D2
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
AhnLab-V3	Trojan/Win32.AgentTesla.C4174255
BitDefenderTheta	Gen:NN.ZelphiF.34144.MGW@aefWErhi
ALYac	Trojan.GenericKD.43573714
ESET-NOD32	a variant of Win32/Injector.EMVB
Rising	Trojan.Injector!1.C961 (CLOUD)
SentinelOne	DFI – Suspicious Archive
AVG	Win32:Trojan-gen
Qihoo-360	Win32/Trojan.ed1

How to remove Ransom:Win32/GandCrab.SK!MTB?

Ransom:Win32/GandCrab.SK!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X