Ransom:Win32/LockerGoga.D removal tips

The Ransom:Win32/LockerGoga.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/LockerGoga.D virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ransom:Win32/LockerGoga.D?


File Info:
crc32: 75431B31
md5: 64ba02ddf70aa23fb8639466fec29ba8
name: 64BA02DDF70AA23FB8639466FEC29BA8.mlw
sha1: 94359c7723d8edc77777dbec66014b34b964e970
sha256: 1a742d68477fb2f2546ab2a3ef97d6f7c0f29844a0a10896f30e474e8d4cd4b6
sha512: a0ef7b2887a9dc458c2f811bbd3ea732826e3747117c1a2c02511cacc9f382cf7fe3b81c0c92598d452c1023a26b8a19590a39682829720600721b8045a4780f
ssdeep: 24576:lexvLtv0Fall+KbqTwd20tR/ckUGx/AVSH5OTpe1:QTtv0FacUckU6/ALTp+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) ALISA LTD 2019
InternalName: tgytutrc
FileVersion: 1.5.1.0
CompanyName: ALISA LTD
ProductName: Service tgytutrc
ProductVersion: 1.5.1.0
FileDescription: Background Tasks Host
OriginalFilename: tgytutrc
Translation: 0x0000 0x04b0

Ransom:Win32/LockerGoga.D also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.GenericRI.S15827196
ALYac	Gen:Variant.Ransom.LockerGoga.67
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.df70aa
Cyren	W32/LockerGoga.C.gen!Eldorado
Symantec	Ransom.GoGalocker!g2
ESET-NOD32	a variant of Win32/Filecoder.LockerGoga.D
Avast	Win32:RansomX-gen [Ransom]
ClamAV	Win.Ransomware.Lockergoga-6918486-0
Kaspersky	HEUR:Trojan-Ransom.Win32.LockerGoga.gen
BitDefender	Gen:Variant.Ransom.LockerGoga.67
MicroWorld-eScan	Gen:Variant.Ransom.LockerGoga.67
Ad-Aware	Gen:Variant.Ransom.LockerGoga.67
Sophos	Troj/Ransom-FHG
F-Secure	Heuristic.HEUR/AGEN.1103425
BitDefenderTheta	Gen:NN.ZexaF.34688.nv0@aq!UjTii
TrendMicro	Ransom.Win32.LOCKERGOGA.SMXF
McAfee-GW-Edition	Ransom-Goga!64BA02DDF70A
FireEye	Generic.mg.64ba02ddf70aa23f
Emsisoft	Application.Ransom (A)
Jiangmin	Trojan.Crypren.ob
Avira	HEUR/AGEN.1103425
eGambit	Unsafe.AI_Score_100%
Microsoft	Ransom:Win32/LockerGoga.D
Arcabit	Trojan.Ransom.LockerGoga.67
ZoneAlarm	HEUR:Trojan-Ransom.Win32.LockerGoga.gen
GData	Gen:Variant.Ransom.LockerGoga.67
AhnLab-V3	Malware/Win32.Ransom.R260303
McAfee	Ransom-Goga!64BA02DDF70A
MAX	malware (ai score=87)
Malwarebytes	Backdoor.Remcos
TrendMicro-HouseCall	Ransom.Win32.LOCKERGOGA.SMXF
Rising	Malware.Heuristic!ET#97% (RDMK:cmRtazrg42pYy831lOlUa58dgo/4)
Yandex	Trojan.GenAsa!XscSbO6+MJA
Ikarus	Trojan-Ransom.LockerGoga
Fortinet	W32/LockerGoga.D!tr.ransom
AVG	Win32:RansomX-gen [Ransom]

How to remove Ransom:Win32/LockerGoga.D?

Ransom:Win32/LockerGoga.D removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X