Ransom

How to remove “Ransom:Win32/Genasom.GI”?

Malware Removal

The Ransom:Win32/Genasom.GI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom:Win32/Genasom.GI virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Sniffs keystrokes
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Ransom:Win32/Genasom.GI?


File Info:

crc32: 094165D7
md5: 681b6926c216a819ffde76b6e4b440b9
name: 681B6926C216A819FFDE76B6E4B440B9.mlw
sha1: d840d43a443bd5d99c4cc2dc0651c692af0646ab
sha256: df14dda488c3f23350f425d4d9fe6e45edc9be1086738755ad2c259e4a55cfd2
sha512: 6967ecf91536856dd12cf02b37b8394b9e5b089a6088bd7bf15a45fa65620db6c3c86dce20499924be949c77fce920d1bfad6036d7e68b923b33ab7083e136ea
ssdeep: 768:wcfuVAGpk2xV03aEZ3sNnaGX0ojo6tQWP6S6SgBbOsuG+:wcf4lVGaEaaGXTcF9SgIB
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/Genasom.GI also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 003919f91 )
Elasticmalicious (high confidence)
DrWebTrojan.Packed.22544
CynetMalicious (score: 100)
CAT-QuickHealRansom.Genasom
ALYacTrojan.Generic.KD.611058
CylanceUnsafe
ZillyaTrojan.Birele.Win32.174
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_80% (D)
AlibabaRansom:Win32/PornoAsset.0a80c829
K7GWTrojan ( 003919f91 )
Cybereasonmalicious.6c216a
CyrenW32/Zbot.EV.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/LockScreen.AJU
ZonerTrojan.Win32.7186
APEXMalicious
TotalDefenseWin32/Ransom.AJB
AvastWin32:Karagany-FS [Trj]
KasperskyTrojan-Ransom.Win32.PornoAsset.fze
BitDefenderTrojan.Generic.KD.611058
NANO-AntivirusTrojan.Win32.Birele.pwobn
MicroWorld-eScanTrojan.Generic.KD.611058
TencentMalware.Win32.Gencirc.114991ee
Ad-AwareTrojan.Generic.KD.611058
SophosML/PE-A + Troj/Zbot-BTY
ComodoTrojWare.Win32.Agent.ITA@4oeprm
BitDefenderThetaAI:Packer.8600E16221
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_Genasom.R002C0CB421
McAfee-GW-EditionPWS-Zbot.gen.ya
FireEyeGeneric.mg.681b6926c216a819
EmsisoftTrojan.Generic.KD.611058 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Birele.aik
AviraTR/Matsnu.CRZY
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftRansom:Win32/Genasom.GI
ArcabitTrojan.Generic.KD.D952F2
AegisLabTrojan.Win32.PornoAsset.j!c
ZoneAlarmTrojan-Ransom.Win32.PornoAsset.fze
GDataTrojan.Generic.KD.611058
AhnLab-V3Dropper/Win32.AdrenaPatched.R32898
McAfeePWS-Zbot.gen.ya
MAXmalware (ai score=100)
VBA32Malware-Cryptor.Inject.gen
MalwarebytesMachineLearning/Anomalous.100%
PandaTrj/CI.A
TrendMicro-HouseCallRansom_Genasom.R002C0CB421
RisingRansom.Genasom!8.293 (CLOUD)
IkarusTrojan.Win32.Ransom
FortinetW32/Injector.QTE!tr
AVGWin32:Karagany-FS [Trj]
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.49e

How to remove Ransom:Win32/Genasom.GI?

Ransom:Win32/Genasom.GI removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment