What is “Ransom:Win32/Pocrimcrypt!rfn”?

The Ransom:Win32/Pocrimcrypt!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/Pocrimcrypt!rfn virus can do?

• Reads data out of its own binary image
• Attempts to modify desktop wallpaper
• Network activity detected but not expressed in API logs
• Anomalous binary characteristics

How to determine Ransom:Win32/Pocrimcrypt!rfn?

File Info:
crc32: 26821423
md5: 6ceb89615fe636e28cdaa6f2989162a7
name: 6CEB89615FE636E28CDAA6F2989162A7.mlw
sha1: 7b9c9b94ee4b7d90daed30d30eb2f586a9bef470
sha256: aa21cd3aae7bf488655c16c7d8b860b8524ce9a5d1c6e746fcd2baba007d97fe
sha512: 5ac04130b8f231995556cd6a4159660210d1926ff43637b91d6eafb5059004bde46ab81c80e61830189c03503002149b266c8a5d664694ddd300d0120cd5e52a
ssdeep: 12288:ohkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aJPU:QRmJkcoQricOIQxiZY1ia5U
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
FileVersion: 3, 3, 8, 1
FileDescription: 
Translation: 0x0809 0x04b0

Ransom:Win32/Pocrimcrypt!rfn also known as:

How to remove Ransom:Win32/Pocrimcrypt!rfn?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.