How to remove “Ransom:Win32/LockerGoga”?

The Ransom:Win32/LockerGoga is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/LockerGoga virus can do?

Anomalous binary characteristics

How to determine Ransom:Win32/LockerGoga?


File Info:
crc32: AC72AF61
md5: 0a825b5698035a0d4632599a76469dfc
name: 0A825B5698035A0D4632599A76469DFC.mlw
sha1: a61db3b343a0e4e6772d2b786adfe834238c8fa3
sha256: f019d443ede58d9024650059e93af427527faec3b4eeb6cf247fb3b387431d6e
sha512: 03896cda69534f9d910153b4fdb2fa7ab518ef04b74b1604b92ae95942398732d4750488608452783fb649df191088efd41632fbabab03e2c9d965da6a9ea310
ssdeep: 24576:aIACtyzqZmWomPY0lJxXVhomeA1DUcQ5dTYLAFZTp+Xjsytcm:oCtyzqZmWomwA7edTYcZTp+Xjsytcm
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) ALISA LTD 2019
InternalName: zzbdrimp
FileVersion: 1.4.4.0
CompanyName: ALISA LTD
ProductName: Service zzbdrimp
ProductVersion: 1.4.4.0
FileDescription: Background Tasks Host
OriginalFilename: zzbdrimp
Translation: 0x0000 0x04b0

Ransom:Win32/LockerGoga also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34610456
FireEye	Generic.mg.0a825b5698035a0d
ALYac	Trojan.Ransom.LockerGoga
Cylance	Unsafe
Sangfor	Ransom.Win32.LockerGoga.mt
BitDefender	Trojan.GenericKD.34610456
Cybereason	malicious.698035
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Ransomware.Lockergoga-6918486-0
Kaspersky	HEUR:Trojan-Ransom.Win32.LockerGoga.gen
Alibaba	Ransom:Win32/LockerGoga.ba3c52da
Rising	Ransom.LockerGoga!1.B635 (CLOUD)
Ad-Aware	Trojan.GenericKD.34610456
Emsisoft	Trojan.GenericKD.34610456 (B)
DrWeb	Trojan.Encoder.27213
Zillya	Trojan.LockerGoga.Win32.4
McAfee-GW-Edition	BehavesLike.Win32.Virut.th
Sophos	Mal/Generic-S + Mal/Dampatch-A
Ikarus	Trojan-Ransom.LockerGoga
Avira	TR/Crypt.XPACK.Gen
eGambit	Unsafe.AI_Score_97%
Antiy-AVL	Trojan[Ransom]/Win32.LockerGoga
Microsoft	Ransom:Win32/LockerGoga
Arcabit	Trojan.Generic.D2101D18
ZoneAlarm	HEUR:Trojan-Ransom.Win32.LockerGoga.gen
GData	Trojan.GenericKD.34610456
Cynet	Malicious (score: 100)
McAfee	Artemis!0A825B569803
MAX	malware (ai score=88)
Malwarebytes	Malware.Heuristic.1003
Panda	Generic Suspicious
Tencent	Win32.Trojan.Lockergoga.Gvi
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Encoder.2438!tr
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Ransom.LockerGoga.HgIASOgA

How to remove Ransom:Win32/LockerGoga?

Ransom:Win32/LockerGoga removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X