Ransom:Win32/LockScreen.AO removal guide

The Ransom:Win32/LockScreen.AO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/LockScreen.AO virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Sniffs keystrokes
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ransom:Win32/LockScreen.AO?


File Info:
crc32: F0EDC276
md5: 0ffa72887e010c76a23e8c1d8aa55d52
name: 0FFA72887E010C76A23E8C1D8AA55D52.mlw
sha1: 68483bf316d0bb339332d68e9d1eb07d16dbce8d
sha256: 3650d6fff966a3d1c7d2e423826b30c96fe653d36a93075dd64063c988768935
sha512: 55e6688558e740cd020f98629f6deea06008d0c04360de373a3ccc57dfbedde0d9d87c0f1527c7b2ae4226d018ffbd44425e6e1286efb488a016467da2a527e1
ssdeep: 6144:v9MplDtkOxYjVoMp37vZ2AmFY/ctq5sMoEKBe4Vjv/HsKfo+48MSjm:voDtkOxYjxTZLmFYktQsMoN5vUMo+48
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
0: [No Data]

Ransom:Win32/LockScreen.AO also known as:

Bkav	W32.MosquitoQKB.Fam.Trojan
DrWeb	Trojan.Winlock.2741
MicroWorld-eScan	Gen:Variant.Ser.Razy.10733
FireEye	Generic.mg.0ffa72887e010c76
ALYac	Gen:Variant.Ser.Razy.10733
Cylance	Unsafe
VIPRE	Packed.Win32.PWSZbot.gen (v)
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Ser.Razy.10733
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.34590.wmGfaOpFedgc
Cyren	W32/FakeAlert.MW.gen!Eldorado
Symantec	Packed.Generic.318
APEX	Malicious
Avast	FileRepMalware
ClamAV	Win.Trojan.Agent-1047960
Kaspersky	Trojan-Ransom.Win32.Gimemo.vc
Alibaba	Ransom:Win32/LockScreen.5ede7c51
NANO-Antivirus	Trojan.Win32.Gimemo.bwsfv
ViRobot	Trojan.Win32.A.Gimemo.363008.A[UPX]
AegisLab	Trojan.Win32.Gimemo.j!c
Tencent	Win32.Trojan.Gimemo.Lju
Ad-Aware	Gen:Variant.Ser.Razy.10733
Emsisoft	Gen:Variant.Ser.Razy.10733 (B)
Comodo	Suspicious@#1dxndqxut15lw
F-Secure	Trojan.TR/Crypt.XPACK.Gen
Zillya	Trojan.Gimemo.Win32.96
TrendMicro	TROJ_CRYPTR.SMKV
McAfee-GW-Edition	W32/Pinkslipbot.gen.ae
Sophos	Mal/Generic-R + Mal/Zbot-EZ
Ikarus	Trojan-Ransom.PornoBlocker
Jiangmin	Trojan/Gimemo.hj
eGambit	Generic.Malware
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Ransom:Win32/LockScreen.AO
Arcabit	Trojan.Ser.Razy.D29ED
SUPERAntiSpyware	Trojan.Agent/Gen-DitherC
ZoneAlarm	Trojan-Ransom.Win32.Gimemo.vc
GData	Gen:Variant.Ser.Razy.10733
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Zbot.R2835
McAfee	Artemis!0FFA72887E01
MAX	malware (ai score=100)
VBA32	Trojan.Zeus.EA.0999
Malwarebytes	Malware.Heuristic.1003
Panda	Generic Malware
ESET-NOD32	Win32/LockScreen.YL
TrendMicro-HouseCall	TROJ_CRYPTR.SMKV
Rising	Ransom.LockScreen!8.83D (CLOUD)
Yandex	Trojan.GenAsa!8c3/CbzS8Tg
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1720719.susgen
Fortinet	W32/Krap.A!tr
AVG	FileRepMalware
Cybereason	malicious.87e010
Qihoo-360	Win32/Ransom.Gimemo.HgIASOYA

How to remove Ransom:Win32/LockScreen.AO?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ransom:Win32/LockScreen.AO removal guide