Trojan.Ransom.WannaCryptor removal

The Trojan.Ransom.WannaCryptor is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Ransom.WannaCryptor virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Presents an Authenticode digital signature
• Creates RWX memory
• A process attempted to delay the analysis task.
• Attempts to connect to a dead IP:Port (964 unique times)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Attempts to modify proxy settings

How to determine Trojan.Ransom.WannaCryptor?

File Info:
name: CCBD3A1ACDF662C4C556.mlw
path: /opt/CAPEv2/storage/binaries/a7c3ce181e5c3956bb6b9b92e862b6fea6d6d3be1a38321ebb84428dde127677
crc32: A38FDB3F
md5: ccbd3a1acdf662c4c556fceada101b84
sha1: c39214bdc7709bccdb1b08d8379a28023786a1ec
sha256: a7c3ce181e5c3956bb6b9b92e862b6fea6d6d3be1a38321ebb84428dde127677
sha512: 823b5007bf194cc8995a42281ae28479dc0452138d62d0a6712540869b7474b9b88fc88f9e6c5d4343696bbbfbcbdd0c6ec5f75f0d6298122c970088bb85dcab
ssdeep: 98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3S:dDqPe1Cxcxk3ZAEUadzR8yc4gi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14C0633A8961DA1BCF0050EB084928557DBBB3C57B7FA592FCF8045660E43B6F9BC0E61
sha3_384: 6b107e9a323838bb1e7e0ba2c04aba1ac5e704147bd32aed7e237bc5f86404b4e0414d3a0f1bfb4bb2fec04088a5fcca
ep_bytes: 558bec6aff68a0a1400068a29b400064
timestamp: 2010-11-20 09:03:08

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Disk Defragmenter
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName: lhdfrgui.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: lhdfrgui.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7601.17514
Translation: 0x0409 0x04b0

Trojan.Ransom.WannaCryptor also known as:

How to remove Trojan.Ransom.WannaCryptor?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.