Ransom • Trojan

Trojan-Ransom.Win32.CryptXXX.asdhqp removal instruction

The Trojan-Ransom.Win32.CryptXXX.asdhqp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-Ransom.Win32.CryptXXX.asdhqp virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Unconventionial language used in binary resources: Russian
Anomalous binary characteristics

How to determine Trojan-Ransom.Win32.CryptXXX.asdhqp?


File Info:
crc32: 0BD9DF91
md5: 4b93e650472799def48f62a067bf3135
name: 4B93E650472799DEF48F62A067BF3135.mlw
sha1: a44d017f62583b271fd869cf76607ca0c2031237
sha256: 4f9d8206fb1128dedf84f4e9aeb42e3ba89e01748f73f37b3c48d7a1bd34bba4
sha512: 05021b696f480e2db96d8d1443fb9d4b2ce257b48616c601d76243e58aef7ccaa527bb7c8dbc9a02d68bef1c58df513016b45c6234affa49a22c2b1fe666bd4d
ssdeep: 1536:X6qRmoOnVSru9UQ6/4whqIRir52+qnwVRbGUmLm7DLb0:XSdOu0ww2QqPnLb0
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
InternalName: c m d
FileVersion: 2.66
CompanyName:  NirSoft
ProductName:  NirCmd
ProductVersion: 2.66
FileDescription:  NirCmd
OriginalFilename:  NirCmd.exe 
Translation: 0x0409 0x04b1

Trojan-Ransom.Win32.CryptXXX.asdhqp also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 0055dd191 )
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.5047
CAT-QuickHeal	Ransom.Cerber.MUE.A6
ALYac	Gen:Variant.Ransom.CryptXXX.1
Malwarebytes	MachineLearning/Anomalous.100%
Zillya	Trojan.Scatter.Win32.108
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Ransom:Win32/CryptXXX.107d9e06
K7GW	Trojan ( 0055dd191 )
Cybereason	malicious.047279
Cyren	W32/S-b5a1ff1e!Eldorado
Symantec	Ransom.CryptXXX!g17
ESET-NOD32	a variant of Win32/Kryptik.HGEN
Zoner	Probably Heur.ExeHeaderH
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.CryptXXX.asdhqp
BitDefender	Gen:Variant.Ransom.CryptXXX.1
NANO-Antivirus	Trojan.Win32.Crypted.egxspj
MicroWorld-eScan	Gen:Variant.Ransom.CryptXXX.1
Tencent	Win32.Trojan.Kryptik.Pfjn
Ad-Aware	Gen:Variant.Ransom.CryptXXX.1
Sophos	ML/PE-A
BitDefenderTheta	Gen:NN.ZexaF.34142.fy0@aO3owNcQ
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_CRYPMIC.KA
FireEye	Generic.mg.4b93e650472799de
Emsisoft	Gen:Variant.Ransom.CryptXXX.1 (B)
Jiangmin	Trojan.Generic.alcim
Webroot	Trojan.Dropper.Gen
Avira	HEUR/AGEN.1128192
eGambit	Unsafe.AI_Score_95%
Antiy-AVL	Trojan/Generic.ASMalwS.1C05A4F
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Ransom:Win32/Tovicrypt.A
SUPERAntiSpyware	Ransom.Cerber/Variant
GData	Gen:Variant.Ransom.CryptXXX.1
AhnLab-V3	Trojan/Win32.CryptXXX.R188553
Acronis	suspicious
McAfee	Ransomware-GJA!4B93E6504727
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Bagsu
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_CRYPMIC.KA
Rising	Trojan.Generic@ML.100 (RDML:x6k758X2ajOVN09aE+iMoA)
Yandex	Trojan.GenAsa!2DQvpVns1ok
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.FNZR!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Trojan-Ransom.Win32.CryptXXX.asdhqp?

Trojan-Ransom.Win32.CryptXXX.asdhqp removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X