Ransom Trojan

Trojan-Ransom.Win32.Blocker.jxdf removal tips

Malware Removal

The Trojan-Ransom.Win32.Blocker.jxdf is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.Blocker.jxdf virus can do?

  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Network activity detected but not expressed in API logs
  • Creates a copy of itself

How to determine Trojan-Ransom.Win32.Blocker.jxdf?


File Info:

crc32: 94FF8EEE
md5: 9c038e625a13c07781b3595b86b84ea3
name: 9C038E625A13C07781B3595B86B84EA3.mlw
sha1: 6e5300d0ad38c05d958e51d61c66568e4d7bee29
sha256: 4fe3d020549ed0f74111e75603b3fcacb05941133e7506a6cb9c9549baf8e39e
sha512: 819d5dbc70b9aeef575d70e3c7f0bc6ae26cd61adfcebe35f3e1af7f7d1394de716d0bff13a87c65e01de4c6cf84faf02b63a0ab4e74254c51becbb91af522b2
ssdeep: 12288:1Bw4tn8y3AGmEvX+3IdpvX5E6opcLyXTHmHXMZwkw709Pjh:zFtNfmEvX+i/hopIyD6XB4BV
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

Translation: 0x0809 0x04b0

Trojan-Ransom.Win32.Blocker.jxdf also known as:

BkavW32.AIDetect.malware1
K7AntiVirusRiskware ( 0040eff71 )
LionicWorm.Win32.Generic.o!c
DrWebTrojan.Encoder.7161
CynetMalicious (score: 100)
CAT-QuickHealRansom.Autoit.Stampado.A
ALYacTrojan.GenericKD.4364135
CylanceUnsafe
ZillyaTrojan.Blocker.Win32.37022
AlibabaTrojan:Win32/Starter.ali1001008
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.25a13c
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.Philadelphia.G
APEXMalicious
AvastINF:AutoRun-BI [Wrm]
ClamAVWin.Ransomware.Stampado-9796884-0
KasperskyTrojan-Ransom.Win32.Blocker.jxdf
BitDefenderTrojan.GenericKD.4364135
NANO-AntivirusTrojan.Script.AuVir.ekpekr
MicroWorld-eScanTrojan.GenericKD.4364135
TencentWin32.Trojan.Blocker.Htbv
Ad-AwareTrojan.GenericKD.4364135
SophosML/PE-A + Troj/Stampado-A
ComodoMalware@#23ftv8ecfvwld
BitDefenderThetaAI:Packer.618F1AC817
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_STAMPADO.F117BD
McAfee-GW-EditionBehavesLike.Win32.TrojanAitInject.hc
FireEyeGeneric.mg.9c038e625a13c077
EmsisoftTrojan.GenericKD.4364135 (B)
AviraDR/AutoIt.Gen
eGambitUnsafe.AI_Score_78%
MicrosoftRansom:Win32/Stampado.A
ArcabitTrojan.Generic.D429767
GDataTrojan.GenericKD.4364135
AhnLab-V3Trojan/Win32.Blocker.C1846041
McAfeeArtemis!9C038E625A13
MAXmalware (ai score=86)
VBA32Hoax.Blocker
PandaTrj/CI.A
TrendMicro-HouseCallRansom_STAMPADO.F117BD
RisingRansom.Philadelphia/Autoit!1.BA48 (CLASSIC)
IkarusWorm.Win32.Filecoder
FortinetAutoIt/Philadelphia.E!tr
AVGINF:AutoRun-BI [Wrm]
Paloaltogeneric.ml

How to remove Trojan-Ransom.Win32.Blocker.jxdf?

Trojan-Ransom.Win32.Blocker.jxdf removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment