Ransom:Win32/Shade.PA!MTB removal instruction

The Ransom:Win32/Shade.PA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Ransom:Win32/Shade.PA!MTB virus can do?

• Executable code extraction
• Injection (inter-process)
• Injection (Process Hollowing)
• Creates RWX memory
• Reads data out of its own binary image
• A process created a hidden window
• Executed a process and injected code into it, probably while unpacking
• Collects information about installed applications
• Creates a hidden or system file
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Ransom:Win32/Shade.PA!MTB?

File Info:
crc32: C021DDE3md5: cf1b6aa96b85a7b508ef95cd1c37662aname: 2c.jpgsha1: 335804b3a993b9373737df9dac29521412ea4913sha256: e56e1200606a69b07f4d1ad086229292852b6dc3ea0d377721ae739a4a75bf4bsha512: d64c5eee51e8f9acb7ea2cd92c4abc6ab49ac3aa4833a0e39c5c28c8b1391bd7c4ea3de011c70b8e8e9772bd4c190511286d859534b79cc32e7e23196d808929ssdeep: 49152:3TwqJLGfXVHYVGVhi0xsHzH2mGu9vt49NcQ:3PiFugfmTWmVxybtype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
0: [No Data]

Ransom:Win32/Shade.PA!MTB also known as:

MicroWorld-eScan	Trojan.GenericKD.32592113
CAT-QuickHeal	Ransom.Stop.MP4
McAfee	Trojan-FRNO!CF1B6AA96B85
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.4!c
K7AntiVirus	Trojan ( 00559b441 )
Alibaba	Trojan:Win32/Miner.cb53aa76
K7GW	Trojan ( 00559b441 )
CrowdStrike	win/malicious_confidence_90% (W)
F-Prot	W32/Kryptik.AKJ.gen!Eldorado
Symantec	Downloader
ESET-NOD32	a variant of Win32/Kryptik.GXJV
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Agent-7339412-0
Kaspersky	Trojan.Win32.Miner.aahgi
BitDefender	Trojan.GenericKD.32592113
NANO-Antivirus	Trojan.Win32.Miner.gdtzra
Rising	Trojan.Kryptik!1.BDF7 (CLASSIC)
Ad-Aware	Trojan.GenericKD.32592113
Emsisoft	Trojan.Agent (A)
Comodo	Malware@#3ndbbov2jjyn2
F-Secure	Trojan.TR/AD.Troldesh.jxpvq
DrWeb	Trojan.Encoder.858
Zillya	Trojan.Kryptik.Win32.1792090
TrendMicro	Ransom.Win32.SHADE.THJBAAI
McAfee-GW-Edition	BehavesLike.Win32.Ransom.tm
Fortinet	W32/Kryptik.GXHG!tr
FireEye	Generic.mg.cf1b6aa96b85a7b5
Sophos	Mal/GandCrab-G
Ikarus	Ransom.Win32.Shade
Cyren	W32/Kryptik.AKJ.gen!Eldorado
Jiangmin	Trojan.Miner.izo
Webroot	W32.Trojan.Gen
Avira	TR/AD.Troldesh.jxpvq
MAX	malware (ai score=87)
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D1F150F1
ZoneAlarm	Trojan.Win32.Miner.aahgi
Microsoft	Ransom:Win32/Shade.PA!MTB
AhnLab-V3	Trojan/Win32.MalPe.R294847
Acronis	suspicious
VBA32	BScope.Trojan.Wacatac
ALYac	Trojan.Ransom.Shade
Malwarebytes	Trojan.MalPack.GS
Panda	Generic Malware
TrendMicro-HouseCall	Ransom.Win32.SHADE.THJBAAI
Yandex	Trojan.Miner!vpy04J2tw7I
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.74635156.susgen
GData	Trojan.GenericKD.32592113
BitDefenderTheta	Gen:Trojan.Heur2.PPBB.3.0.Mz0@cW3DQmoi7d
AVG	Win32:RansomX-gen [Ransom]
Avast	Win32:RansomX-gen [Ransom]
Qihoo-360	HEUR/QVM10.2.949D.Malware.Gen

How to remove Ransom:Win32/Shade.PA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.