Ransom Trojan

Trojan-Ransom.Win32.Blocker.jwvh removal instruction

Malware Removal

The Trojan-Ransom.Win32.Blocker.jwvh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.Blocker.jwvh virus can do?

  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself

How to determine Trojan-Ransom.Win32.Blocker.jwvh?


File Info:

crc32: 2DE0DFFF
md5: fe4d26dbb084a1577de9da5e8ae8449c
name: FE4D26DBB084A1577DE9DA5E8AE8449C.mlw
sha1: aa885a7d036edb2507450921002612265a38a5ea
sha256: fda5f9b3ce6ec9fee8c50f57a7fb793623091d5385bc893fda8e742fc94c4d70
sha512: e54c46516ad88af57fa794638bf03d14d6ef5f70224855f1e22d095104624dbee5a686ed9a9a5f277c0eb78f0753fb76bf188a2f5cb952aa8e8095ce25fb57a7
ssdeep: 12288:SBw4tn8y3AGmEvX+3IdpvX5E6opcLyXTHBsRJE6Ov4yx++h2/LP7g+u6FFqPgY:4FtNfmEvX+i/hopIyDyRJE6uh
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

Translation: 0x0809 0x04b0

Trojan-Ransom.Win32.Blocker.jwvh also known as:

BkavW32.AIDetect.malware1
K7AntiVirusRiskware ( 0040eff71 )
DrWebTrojan.Encoder.7161
CynetMalicious (score: 100)
CAT-QuickHealRansom.Autoit.Stampado.A
ALYacTrojan.GenericKD.4273863
CylanceUnsafe
SangforRansom.Win32.Blocker.jwvh
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaTrojan:Win32/Starter.ali1001008
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.bb084a
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.Philadelphia.G
APEXMalicious
AvastINF:AutoRun-BI [Wrm]
ClamAVWin.Ransomware.Stampado-9796884-0
KasperskyTrojan-Ransom.Win32.Blocker.jwvh
BitDefenderTrojan.GenericKD.4273863
NANO-AntivirusTrojan.Script.AuVir.ekpekr
MicroWorld-eScanTrojan.GenericKD.4273863
TencentWin32.Trojan.Raas.Auto
Ad-AwareTrojan.GenericKD.4273863
SophosML/PE-A + Troj/Stampado-A
ComodoMalware@#2s04wo220lfwp
BitDefenderThetaAI:Packer.618F1AC817
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_STAMPADO.F117AV
McAfee-GW-EditionBehavesLike.Win32.TrojanAitInject.hc
FireEyeGeneric.mg.fe4d26dbb084a157
EmsisoftTrojan.GenericKD.4273863 (B)
JiangminTrojan.Inject.asio
AviraDR/AutoIt.Gen
MicrosoftRansom:Win32/Stampado.A
GDataTrojan.GenericKD.4273863
McAfeeArtemis!FE4D26DBB084
MAXmalware (ai score=88)
MalwarebytesMalware.AI.1070146240
PandaTrj/CI.A
TrendMicro-HouseCallRansom_STAMPADO.F117AV
RisingRansom.Stampado!8.E0DE (C64:YzY0OpzS3wwq8WHI)
IkarusTrojan-Ransom.Stampado
FortinetAutoIt/Philadelphia.E!tr
AVGINF:AutoRun-BI [Wrm]
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.Blocker.HwsBEpsA

How to remove Trojan-Ransom.Win32.Blocker.jwvh?

Trojan-Ransom.Win32.Blocker.jwvh removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment