Categories: Ransom

How to remove “Troj/Ransom-CPS”?

The Troj/Ransom-CPS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/Ransom-CPS virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Likely installs a bootkit via raw harddisk modifications
Attempts to restart the guest VM
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Troj/Ransom-CPS?


File Info:
crc32: 488C77E7md5: af2379cc4d607a45ac44d62135fb7015name: AF2379CC4D607A45AC44D62135FB7015.mlwsha1: 39b6d40906c7f7f080e6befa93324dddadcbd9fasha256: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739sha512: 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99ssdeep: 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6ftype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Troj/Ransom-CPS also known as:

MicroWorld-eScan	Trojan.Ransom.Petya.C
nProtect	Trojan/W32.Agent.230912.JI
CAT-QuickHeal	Ransom.Petya.S5
ALYac	Trojan.Ransom.Petya
Malwarebytes	Ransom.Petya
Zillya	Trojan.Petr.Win32.1
CrowdStrike	malicious_confidence_97% (W)
K7GW	Trojan ( 004e14a51 )
K7AntiVirus	Trojan ( 004e14a51 )
Arcabit	Trojan.Ransom.Petya.C
TrendMicro	Ransom_PETYA.A
Cyren	W32/Petya.NREO-5105
Symantec	Ransom.Petya
ESET-NOD32	Win32/Diskcoder.Petya.A
Zoner	Trojan.Petya
TheHacker	Trojan/Diskcoder.Petya.a
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Petya-5637914-0
Kaspersky	Trojan-Ransom.Win32.Petr.a
BitDefender	Trojan.Ransom.Petya.C
NANO-Antivirus	Trojan.Win32.Crypted.ebffer
ViRobot	Trojan.Win32.Z.Petya.230912.A[h]
SUPERAntiSpyware	Ransom.Petya/Variant
Tencent	Win32.Trojan.Petya.Jbdu
Endgame	malicious (high confidence)
Sophos	Troj/Ransom-CPS
Comodo	TrojWare.Win32.Petya.A
F-Secure	Trojan:W32/Petya.A
DrWeb	Trojan.Ransom.369
VIPRE	Trojan.Win32.Generic!BT
Invincea	virus.win32.ramnit.j
McAfee-GW-Edition	Ransom-Petya
Emsisoft	Trojan.Ransom.Petya.C (B)
SentinelOne	static engine – malicious
F-Prot	W32/Petya.A
Webroot	Ransomware.Petya.Gen
Avira	TR/Crypt.Xpack.jvzj
Antiy-AVL	Trojan/Win32.TGeneric
Microsoft	Ransom:Win32/Petya.A
Ad-Aware	Trojan.Ransom.Petya.C
AegisLab	Troj.Ransom.W32!c
ZoneAlarm	Trojan-Ransom.Win32.Petr.a
GData	Win32.Trojan-Ransom.Petya.B
AhnLab-V3	Trojan/Win32.Ransom.R177575
McAfee	Ransom-Petya
AVware	Trojan.Win32.Generic!BT
Panda	Trj/RansomCrypt.E
TrendMicro-HouseCall	Ransom_PETYA.A
Rising	Trojan.Generic (cloud:8G0iAG3P7YV)
Yandex	Trojan.Petr!
Ikarus	Trojan.Win32.Diskcoder
Fortinet	W32/Petr.A!tr
AVG	FileCryptor.JMV
Paloalto	generic.ml
Qihoo-360	HEUR/QVM10.1.Malware.Gen