Ransom

How to remove “Ransom:Win32/Pocrimcrypt.A”?

Malware Removal

The Ransom:Win32/Pocrimcrypt.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom:Win32/Pocrimcrypt.A virus can do?

  • Detected script timer window indicative of sleep style evasion
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • A process created a hidden window
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Attempts to modify desktop wallpaper
  • Creates a hidden or system file
  • Network activity detected but not expressed in API logs
  • Attempts to disable UAC
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Ransom:Win32/Pocrimcrypt.A?


File Info:

crc32: C59FD203
md5: d0c9c12d7ebd3303ea9ffec0f12c342b
name: fixer.exe
sha1: 59e09112196a0eecb54c8ac1045f8dc5883de053
sha256: 6fdbeac5cadfadd403b0494a74c44f84763ff69111f3c8f6bcb8481dd6336f28
sha512: 3c1ccdf4872d5b9064d2d9570085c6c77249c298f8768ab1fcb6acabe73b07762ef7633a312a5ecb1ae200ee9c62286407eeae7618e9a92adec3a848ed5b10e6
ssdeep: 24576:oRmJkcoQricOIQxiZY1iaDZkFuYaTYlst:NJZoQrbTFZY1iaDqFKsst
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
FileVersion: 3, 3, 8, 1
FileDescription:
Translation: 0x0809 0x04b0

Ransom:Win32/Pocrimcrypt.A also known as:

BkavW32.CasekasDVF.Trojan
MicroWorld-eScanGen:Variant.Ransom.Locked.2
FireEyeGeneric.mg.d0c9c12d7ebd3303
CAT-QuickHealTrojanSpy.Banker
ALYacGen:Variant.Ransom.Locked.2
CylanceUnsafe
K7AntiVirusTrojan ( 0055e3ef1 )
BitDefenderGen:Variant.Ransom.Locked.2
K7GWTrojan ( 0055e3ef1 )
Cybereasonmalicious.d7ebd3
TrendMicroRansom.AutoIt.CRYPTEIGHT.SMTH
BitDefenderThetaAI:Packer.4A72867A16
F-ProtW32/Autoit.ABJ
SymantecRansom.Cryptolocker
ESET-NOD32Win32/Spy.Banker.ADES
TrendMicro-HouseCallRansom.AutoIt.CRYPTEIGHT.SMTH
AvastAutoIt:Ransom-L [Trj]
ClamAVWin.Malware.Autoit-6992337-0
GDataGen:Variant.Ransom.Locked.2
KasperskyHEUR:Exploit.Script.BypassUAC.gen
NANO-AntivirusTrojan.Win32.Bankfraud.efjtmx
APEXMalicious
Endgamemalicious (high confidence)
EmsisoftGen:Variant.Ransom.Locked.2 (B)
F-SecureTrojan.TR/Bancker.8888
DrWebTrojan.Encoder.24597
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Ransom.cc
Trapminemalicious.moderate.ml.score
SophosMal/Generic-S
CyrenW32/Autoit.XNSP-2917
JiangminTrojan.Banker.Agent.cal
MaxSecureTrojan.Autoit.AZA
AviraTR/Bancker.8888
MAXmalware (ai score=88)
Antiy-AVLTrojan[Ransom]/Win32.AutoItLock.a
ArcabitTrojan.Ransom.Locked.2
AhnLab-V3Trojan/Win32.FileCoder.R291305
ZoneAlarmHEUR:Exploit.Script.BypassUAC.gen
MicrosoftRansom:Win32/Pocrimcrypt.A
Acronissuspicious
Ad-AwareGen:Variant.Ransom.Locked.2
MalwarebytesRansom.Microcop
RisingSpyware.Banker!8.8D (CLOUD)
YandexTrojan.Bankfraud!
IkarusTrojan-Ransom.Crypt888
eGambitUnsafe.AI_Score_75%
FortinetW32/Filecoder.DYB!tr
AVGAutoIt:Ransom-L [Trj]
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360HEUR/QVM10.1.8DD9.Malware.Gen

How to remove Ransom:Win32/Pocrimcrypt.A?

Ransom:Win32/Pocrimcrypt.A removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment