Ransom:Win32/Genasom.JU information

The Ransom:Win32/Genasom.JU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/Genasom.JU virus can do?

• Executable code extraction
• Presents an Authenticode digital signature
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• A process created a hidden window
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Mimics the file times of a Windows system file
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Ransom:Win32/Genasom.JU?

File Info:
crc32: 33D00F29
md5: 02c4a5dd93ef479a0e987b02a23d3848
name: 02C4A5DD93EF479A0E987B02A23D3848.mlw
sha1: 4305cd223931349c947efdff4f4f16bfadca31d9
sha256: 64b76871852119575e50b3a3751e36a482e0a428dca964be5e5a9fec7b81a529
sha512: ac16fdb2817aeb2a8c0f62d34846a134429a811863f909cd1f23f7e4ec0f6cbd5d824d631a5e70083769c1fc4e84a4cc4022f05e23340b34febc3c1a267c1d29
ssdeep: 3072:LOWmZ8R2xBu8m/3o8m0+yZVeIw5UvMkePXF:LOHZTxBux3Pm3ya5UvE
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) Microsoft Corp. 1991-1996
InternalName: WINHSTB
FileVersion: 5.00.2134.1
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows (R) 2000 Operating System
ProductVersion: 5.00.2134.1
FileDescription: Windows Winhlp32 Stub
OriginalFilename: WINHLP32.EXE
Translation: 0x0409 0x04b0

Ransom:Win32/Genasom.JU also known as:

How to remove Ransom:Win32/Genasom.JU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.