Categories: RansomTrojan

Trojan-Ransom.Win32.Democry.b removal guide

The Trojan-Ransom.Win32.Democry.b is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.Democry.b virus can do?

  • Possible date expiration check, exits too soon after checking local time
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine Trojan-Ransom.Win32.Democry.b?


File Info:

crc32: 2FF1BB03md5: 64c10370dcedb31e0d72bbcd2fd7d6b1name: 64C10370DCEDB31E0D72BBCD2FD7D6B1.mlwsha1: e30790af42ce139f1522f271c6843110b606f52csha256: e269dd9bdb2e031d6d14eabd9735f1d159b5b389097a62d268851c74517947b3sha512: 4f09218b59b3e6b2268ed51afe92f6af693228632c7a0cea3b84e1132c006c5ac09995c9882d49d1a4de39f467fa237a49c7e9d3a5d599d2e6922d81e78a8b0fssdeep: 768:D1bgtZMyqyzDUG+abSQ/yQk1o1ROClHS9ikz8F9Tlralu:D1EZMyBDUPa+Q/y1e1kKHOik8lrhtype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan-Ransom.Win32.Democry.b also known as:

Bkav W32.AIDetect.malware2
K7AntiVirus Trojan ( 0055e3ef1 )
Lionic Trojan.Win32.Democry.j!c
Elastic malicious (high confidence)
DrWeb Trojan.Encoder.4608
Cynet Malicious (score: 100)
ALYac Gen:Heur.Mint.Zard.5
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_70% (D)
Alibaba Ransom:Win32/Democry.1c2c9d95
K7GW Trojan ( 0055e3ef1 )
Cybereason malicious.0dcedb
Symantec Ransom.777
ESET-NOD32 a variant of Win32/Filecoder.NGQ
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Trojan.Symmi-1791
Kaspersky Trojan-Ransom.Win32.Democry.b
BitDefender Gen:Heur.Mint.Zard.5
NANO-Antivirus Trojan.Win32.Encoder.ecqrco
MicroWorld-eScan Gen:Heur.Mint.Zard.5
Tencent Ransom.Win32.777.a
Ad-Aware Gen:Heur.Mint.Zard.5
Sophos Mal/Generic-S
BitDefenderTheta Gen:NN.ZexaCO.34170.jrZ@a0UZoKl
VIPRE Trojan.Win32.Generic!BT
TrendMicro Ransom_DEMOCRY.SM
McAfee-GW-Edition BehavesLike.Win32.BadFile.tz
FireEye Generic.mg.64c10370dcedb31e
Emsisoft Gen:Heur.Mint.Zard.5 (B)
SentinelOne Static AI – Malicious PE
Jiangmin Trojan.Democry.b
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1128760
eGambit Unsafe.AI_Score_99%
Antiy-AVL Trojan/Generic.ASMalwS.18BBA89
Microsoft Ransom:Win32/SieteCrypto.A
ZoneAlarm Trojan-Ransom.Win32.Democry.b
GData Win32.Trojan-Ransom.Sevleg.B
TACHYON Ransom/W32.Democry.1197190
AhnLab-V3 Trojan/Win32.Filecoder.R181407
McAfee Artemis!64C10370DCED
MAX malware (ai score=81)
VBA32 BScope.TrojanRansom.Cryptor
Malwarebytes Ransom.FileLocker
Panda Trj/CI.A
TrendMicro-HouseCall Ransom_DEMOCRY.SM
Rising Trojan.Generic@ML.85 (RDML:q814zmj7gvhF3lL5KrLWKA)
Yandex Trojan.Democry!MhhFJF4rXj4
Ikarus Trojan.Win32.Filecoder
Fortinet W32/Generic.AC.3438099
AVG Win32:Malware-gen
Paloalto generic.ml

How to remove Trojan-Ransom.Win32.Democry.b?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Win32/GenKryptik.GVYR removal instruction

The Win32/GenKryptik.GVYR is considered dangerous by lots of security experts. When this infection is active,…

19 mins ago

Fragtor.525921 removal

The Fragtor.525921 is considered dangerous by lots of security experts. When this infection is active,…

24 mins ago

Troj/Steal-DWX removal guide

The Troj/Steal-DWX is considered dangerous by lots of security experts. When this infection is active,…

25 mins ago

MSIL/Kryptik.ALJI removal instruction

The MSIL/Kryptik.ALJI is considered dangerous by lots of security experts. When this infection is active,…

34 mins ago

About “Lazy.477826” infection

The Lazy.477826 is considered dangerous by lots of security experts. When this infection is active,…

34 mins ago

What is “Fragtor.369452”?

The Fragtor.369452 is considered dangerous by lots of security experts. When this infection is active,…

40 mins ago