Trojan.Ransom.Shade.A removal instruction

The Trojan.Ransom.Shade.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Ransom.Shade.A virus can do?

• Executable code extraction
• Creates RWX memory
• Attempts to connect to a dead IP:Port (6 unique times)
• Starts servers listening on 127.0.0.1:59428
• Reads data out of its own binary image
• The binary likely contains encrypted or compressed data.
• A potential decoy document was displayed to the user
• Installs Tor on the infected machine
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a copy of itself
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.Ransom.Shade.A?

File Info:
crc32: 90468AEF
md5: be998214c48ec585057480306b7c1b97
name: BE998214C48EC585057480306B7C1B97.mlw
sha1: 2c9f766257b3f123757b9ad85b0112e8a6c7c187
sha256: 90fec3d45f1fab86458af1564825c6b9bd39d199001020ddef169e0fd98f5cf2
sha512: 2635bf510e14a848c4b564e44cdc56610093ba3e8ab6a3aa75340a5fe71b43e4693c6ea2f803bcd7ed2e1a4c52c7102675505951f476de166c837edd2c788705
ssdeep: 24576:QvBOqi0itT8ofTg8ouVwp1vE5ayaCFC4vNgha3bYM+zTsq+FQsSHScOHIX2SJ/Wl:QZjitto8ouVwp1E9L8IbhukQsSUHSl09
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: (c) 2015 Company 
InternalName: Dial
FileVersion: 7.3.8.29
CompanyName: Ellora Assets Corporation
PrivateBuild: 7.3.8.29
LegalTrademarks: (c) 2015 Company 
Comments: Flag Circle Seller Page Discriminatr Ttals
ProductName: Dial
ProductVersion: 7.3.8.29
FileDescription: Flag Circle Seller Page Discriminatr Ttals
OriginalFilename: Dial
Translation: 0x0409 0x04b0

Trojan.Ransom.Shade.A also known as:

How to remove Trojan.Ransom.Shade.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.