Ransom:Win32/Wadhrama!hoa removal tips

Malware Removal

The Ransom:Win32/Wadhrama!hoa is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom:Win32/Wadhrama!hoa virus can do?

  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Creates a copy of itself

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Ransom:Win32/Wadhrama!hoa?


File Info:

crc32: BC492387
md5: c8ebe6f4b11dbc59aade73500887c200
name: upload_file
sha1: ab1750df17d1a2ccc992833550eacac199e47a7d
sha256: 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5
sha512: 687e0ed5d0f777ff77ee36f341f176cdd25136e82e5d79a0b4f20c19d375841c62adf7dfe9c0742b874d8cc7f12ad2487040761095a2c513c0c0ed6b0e72fe30
ssdeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4AHkicUnWkHfwPPRhzvDfYejZ9kw4n:Qw+asqN5aW/hL6SnWkH2Rhz7f7Z9kw4
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/Wadhrama!hoa also known as:

BkavW32.RansomeDNZ.Trojan
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.3953
MicroWorld-eScanTrojan.Ransom.Crysis.E
FireEyeGeneric.mg.c8ebe6f4b11dbc59
CAT-QuickHealRansom.Crysis.A3
Qihoo-360Win32/Trojan.Ransom.Crusis.A
ALYacTrojan.Ransom.Crysis.E
MalwarebytesRansom.Crysis
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Win32.Crusis.tqMs
K7AntiVirusTrojan ( 00519f781 )
BitDefenderTrojan.Ransom.Crysis.E
K7GWTrojan ( 00519f781 )
Cybereasonmalicious.4b11db
TrendMicroRansom.Win32.CRYSIS.SM
BitDefenderThetaAI:Packer.D3B9457E1E
CyrenW32/Trojan.ILHO-9216
SymantecRansom.Crysis
APEXMalicious
AvastWin32:RansomX-gen [Ransom]
ClamAVWin.Trojan.Dharma-6668198-0
KasperskyTrojan-Ransom.Win32.Crusis.to
AlibabaRansom:Win32/generic.ali2000010
NANO-AntivirusTrojan.Win32.Filecoder.emdnxn
ViRobotTrojan.Win32.Ransom.94720.F
TencentTrojan-Ransom.Win32.Crysis.a
Ad-AwareTrojan.Ransom.Crysis.E
TACHYONRansom/W32.crysis.94720
SophosTroj/Criakl-G
ComodoTrojWare.Win32.Crysis.D@6sd9xy
F-SecureTrojan.TR/Dropper.Gen
InvinceaML/PE-A + Troj/Criakl-G
McAfee-GW-EditionBehavesLike.Win32.RansomDharma.nc
EmsisoftTrojan.Ransom.Crysis.E (B)
JiangminTrojan.Crypren.ic
WebrootW32.Ransom.Gen
AviraTR/Dropper.Gen
Antiy-AVLTrojan/Win32.AGeneric
MicrosoftRansom:Win32/Wadhrama!hoa
ArcabitTrojan.Ransom.Crysis.E
SUPERAntiSpywareRansom.Crysis/Variant
ZoneAlarmTrojan-Ransom.Win32.Crusis.to
GDataWin32.Trojan-Ransom.VirusEncoder.A
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Crysis.R213980
Acronissuspicious
McAfeeRansom-Dharma!C8EBE6F4B11D
MAXmalware (ai score=89)
VBA32TrojanRansom.Crusis
PandaTrj/GdSda.A
ESET-NOD32a variant of Win32/Filecoder.Crysis.P
TrendMicro-HouseCallRansom.Win32.CRYSIS.SM
RisingRansom.Crysis!1.A6AA (CLASSIC)
SentinelOneDFI – Suspicious PE
eGambitUnsafe.AI_Score_79%
FortinetW32/Crysis.W!tr.ransom
AVGWin32:RansomX-gen [Ransom]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan-Ransom.Win32.Crusis.To

How to remove Ransom:Win32/Wadhrama!hoa?

Ransom:Win32/Wadhrama!hoa removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment