What is “Ransom:Win64/DelShad!MSR”?

The Ransom:Win64/DelShad!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win64/DelShad!MSR virus can do?

The binary likely contains encrypted or compressed data.

How to determine Ransom:Win64/DelShad!MSR?


File Info:
crc32: F9D7A37E
md5: 8354d056a9b6e9ceb859fc30c3aba86b
name: 8354D056A9B6E9CEB859FC30C3ABA86B.mlw
sha1: 1b16abc9bfd1a225d024b63d716feb9d1013af12
sha256: e00f437a899499bbd384e6889f07635c8b699e93105b8476667377fce887b1b6
sha512: 8347fb0e3ae3cae321f6148e93fef81098240e693e1f97a053075f6fde50c78204a01d8de35e769d0f586766cedd1a21808316f28edc7a0d8b80a86651b14361
ssdeep: 24576:HlUvSi+l5BdFp+cv0Ixy/Em3BBSnRqeDu50xJPdvcJLgu3XLg6MppTEDjGMksdFV:FkH+rBx6xxuxn+JDIaDj9ksxX
type: PE32+ executable (console) x86-64, for MS Windows

Version Info:
LegalCopyright: xa9 Help corp 2021. All rights reserved.
InternalName: winhelp.exe
FileVersion: 11.27
CompanyName: Help Corp.
ProductName: Help in windows
ProductVersion: 52.49.50.0
FileDescription: Get help and secrets on windows 10.
OriginalFilename: WinSecrets.exe
Translation: 0x0409 0x04b0

Ransom:Win64/DelShad!MSR also known as:

K7AntiVirus	Trojan ( 005784901 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen13.2277
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.Filecoder
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win64.1104
Alibaba	Trojan:Win64/GenKryptik.cfe971dc
K7GW	Trojan ( 005784901 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/GenKryptik.FCCA
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.DelShad.vho
BitDefender	Trojan.GenericKD.36631780
MicroWorld-eScan	Trojan.GenericKD.36631780
Tencent	Win32.Trojan-gamethief.Onlinegames.Dypw
Ad-Aware	Trojan.GenericKD.36631780
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win64.Generic.tc
FireEye	Trojan.GenericKD.36631780
Emsisoft	Trojan.GenericKD.36631780 (B)
Jiangmin	Trojan.DelShad.bmn
Webroot	W32.Trojan.GenKD
Avira	TR/AD.RansomHeur.uidpf
eGambit	Unsafe.AI_Score_94%
Microsoft	Ransom:Win64/DelShad!MSR
GData	Trojan.GenericKD.36631780
AhnLab-V3	Malware/Win64.RL_Generic.R366877
McAfee	Artemis!8354D056A9B6
MAX	malware (ai score=85)
VBA32	Trojan.DelShad
Malwarebytes	Malware.AI.3991371205
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CD821
Rising	Ransom.DelShad!8.118FF (CLOUD)
Yandex	Trojan.DelShad!VQkW6406A/A
Ikarus	Trojan.Win64.Krypt
MaxSecure	Trojan.Malware.74666482.susgen
Fortinet	W64/DelShad.3DF1!tr.ransom
AVG	Win64:MalwareX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Win64/Ransom.Generic.HgEASSEA

How to remove Ransom:Win64/DelShad!MSR?

Ransom:Win64/DelShad!MSR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X