Ransom:Win32/Reveton malicious file

The Ransom:Win32/Reveton is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/Reveton virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the embedded win api malware family
• Creates a copy of itself
• Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom:Win32/Reveton?

File Info:
name: AFA0C423D2DBF2589631.mlw
path: /opt/CAPEv2/storage/binaries/86a0b5328f680041a0018aa8a79faeec33e6a002cd8c045efd887cf311c57bf8
crc32: A41B06FB
md5: afa0c423d2dbf2589631c5e605c9be4a
sha1: 1b3e5d02fa6662ff02437f88bdf80956133efe90
sha256: 86a0b5328f680041a0018aa8a79faeec33e6a002cd8c045efd887cf311c57bf8
sha512: 5e59b057a8e72682230c1cadbfa030849fc18207efcd54a3f38f16f31a143bb75ba8595216d51460e4383a9fb6f1a5bd27ff3951bf919515f296aa6d90c22e75
ssdeep: 3072:aypSyAnE4DutuYkfpfVVoyGejFmZSS/3:aypRAE2utuYkx/VjQ
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T17DD3F109E35AE125CC6758F03922B27160203F3488B949A7BBC17F7DB93B9224575F6B
sha3_384: fd9c53412d53835a25db27deab8a3c03ea9d4e4ac083b62538f1e449c3e2d051a357ebdd4c6f648c8caf17fb91a1bdb2
ep_bytes: 5589e553575681ec08010000c78514ff
timestamp: 2013-11-11 16:35:20

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Disk Label Utility
FileVersion: 5.1.2600.0 (xpclient.010817-1148)
InternalName: Label
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: Label.Exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.0
Translation: 0x0409 0x04b0

Ransom:Win32/Reveton also known as:

How to remove Ransom:Win32/Reveton?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.