Ransom Trojan

Trojan-Ransom.Win32.Blocker.rjku removal guide

Malware Removal

The Trojan-Ransom.Win32.Blocker.rjku is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.Blocker.rjku virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Sniffs keystrokes
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
sunray1975.zapto.org

How to determine Trojan-Ransom.Win32.Blocker.rjku?


File Info:

crc32: B72CB446
md5: 5bb60c5dfdc86647487b94fdf90a6a8a
name: 5BB60C5DFDC86647487B94FDF90A6A8A.mlw
sha1: fa91abd6dfcbaf570f879f97cbe5d3246c9839d5
sha256: d8e7e95bf56783524a62aefd549a80e12b687ed4877249c05775fa25bbcf1632
sha512: a98e3ee0a8aeab89b679bb518c5376eafa4fd9b3e10b66d8fe396999e98db34e75855bdddb960973fd9b321464b59342d62afa500f7e8bdcf362694ce6022f55
ssdeep: 196608:0Oazg7DS8Oazg7DS8Oazg7DS8Oazg7DSv:0g7u8g7u8g7u8g7uv
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan-Ransom.Win32.Blocker.rjku also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 00548e051 )
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader6.7779
CynetMalicious (score: 100)
CAT-QuickHealTrojan.WacatacPMF.S16539689
ALYacGen:Variant.Symmi.34741
CylanceUnsafe
ZillyaTrojan.Injector.Win32.1273646
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaTrojan:Win32/Starter.ali1001008
K7GWTrojan ( 00548e051 )
Cybereasonmalicious.dfdc86
CyrenW32/Injector.OZVT-2500
ESET-NOD32a variant of Win32/Injector.AHHO
APEXMalicious
AvastWin32:MBRlock-DV [Trj]
ClamAVWin.Trojan.Mbrlock-9779766-0
KasperskyTrojan-Ransom.Win32.Blocker.rjku
BitDefenderGen:Variant.Symmi.34741
NANO-AntivirusTrojan.Win32.Dapato.bsjzfg
ViRobotTrojan.Win32.Z.Injector.8316928.YL
MicroWorld-eScanGen:Variant.Symmi.34741
TencentTrojan.Win32.Blocker.zg
Ad-AwareGen:Variant.Symmi.34741
SophosML/PE-A + Troj/Agent-BFYB
ComodoTrojWare.Win32.Injector.HO@82j6jo
BitDefenderThetaAI:Packer.9896AD8521
TrendMicroTROJ_GEN.R03BC0PKC21
McAfee-GW-EditionBehavesLike.Win32.Generic.wc
FireEyeGeneric.mg.5bb60c5dfdc86647
EmsisoftGen:Variant.Symmi.34741 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Blocker.pkq
AviraDR/Delphi.Gen
Antiy-AVLTrojan/Generic.ASMalwS.30ED84C
MicrosoftTrojan:Win32/Injector.INK!MTB
ArcabitTrojan.Symmi.D87B5
GDataWin32.Trojan.PSE.13Q4XMA
TACHYONBackdoor/W32.Androm.8316928
AhnLab-V3Dropper/Win32.Dapato.R83155
Acronissuspicious
McAfeeGenericRXIP-BJ!5BB60C5DFDC8
MAXmalware (ai score=85)
VBA32Trojan.Downloader
MalwarebytesTrojan.Crypt
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_GEN.R03BC0PKC21
RisingTrojan.Injector!1.DA56 (CLASSIC)
YandexTrojan.Injector!nfedw5apY3U
IkarusTrojan-Ransom.Blocker
MaxSecureTrojan.Malware.127304917.susgen
FortinetW32/Injector.AHHO!tr
AVGWin32:MBRlock-DV [Trj]
Paloaltogeneric.ml

How to remove Trojan-Ransom.Win32.Blocker.rjku?

Trojan-Ransom.Win32.Blocker.rjku removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment