Categories: RansomTrojan

Trojan-Ransom.Win32.Encoder.ron removal instruction

The Trojan-Ransom.Win32.Encoder.ron is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.Encoder.ron virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Possible date expiration check, exits too soon after checking local time
  • Anomalous file deletion behavior detected (10+)
  • Dynamic (imported) function loading detected
  • A process created a hidden window
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Exhibits possible ransomware file modification behavior
  • Uses suspicious command line tools or Windows utilities

How to determine Trojan-Ransom.Win32.Encoder.ron?


File Info:

name: EAAC1FCF5D48EC8DD877.mlwpath: /opt/CAPEv2/storage/binaries/8ebf069bcc5d5f24a0e7b30b8f9e8058073dab642bd83f5adf05a05aebc558b1crc32: A44663A9md5: eaac1fcf5d48ec8dd8776df873d122b1sha1: 66fe0b97aee7b8ac161a168312c490eca4b76817sha256: 8ebf069bcc5d5f24a0e7b30b8f9e8058073dab642bd83f5adf05a05aebc558b1sha512: 7482337e089f5b2ec3914923bab00d325cb9bae46a5891c5486f0e5b261f81ed11d16c32d2350db85f25971caca12e718c56f1b2237fc39fc1d34f215ee2bae9ssdeep: 1536:j7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfkxB6Og:/q6+ouCpk2mpcWJ0r+QNTBfkTKtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C7937C45F3E241F7E9E10A3100A6712FA73A66249724E8DBC34C3D829953AD49A7C3F9sha3_384: 210b43f0e056994c70edd67473ae166a50a371bf296f8a4049f671d8ebce3fabdd068baa333e4b48d205e132bf4f1b10ep_bytes: 68ac00000068000000006810804100e8timestamp: 2019-07-30 08:52:50

Version Info:

0: [No Data]

Trojan-Ransom.Win32.Encoder.ron also known as:

Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Tiny.trFe
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.Bat.1
McAfee Artemis!EAAC1FCF5D48
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0055f5011 )
Alibaba Trojan:BAT/KillFiles.ff882a2c
K7GW Trojan ( 0055f5011 )
Cybereason malicious.7aee7b
VirIT Trojan.Win32.Genus.IHW
Cyren W32/Trojan.VFBA-8001
ESET-NOD32 BAT/KillFiles.NPF
APEX Malicious
Avast FileRepMalware [Misc]
Kaspersky Trojan-Ransom.Win32.Encoder.ron
BitDefender Gen:Heur.Bat.1
Ad-Aware Gen:Heur.Bat.1
TACHYON Trojan/W32.KillFiles.89600
Sophos Mal/Generic-S
Zillya Tool.Lazagne.Win32.102
McAfee-GW-Edition BehavesLike.Win32.Generic.mh
FireEye Generic.mg.eaac1fcf5d48ec8d
Emsisoft Gen:Heur.Bat.1 (B)
SentinelOne Static AI – Malicious PE
GData Gen:Heur.Bat.1
Arcabit Trojan.Bat.1
Microsoft Program:Win32/Wacapew.C!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4723677
ALYac Gen:Heur.Bat.1
MAX malware (ai score=85)
Malwarebytes Malware.AI.392946571
TrendMicro-HouseCall TROJ_GEN.R002H09FL22
Rising Ransom.Encoder!8.FFD4 (CLOUD)
Ikarus Trojan.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
AVG FileRepMalware [Misc]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (W)

How to remove Trojan-Ransom.Win32.Encoder.ron?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Generic.Dacic.1A7FA519.A.5C117112 removal instruction

The Generic.Dacic.1A7FA519.A.5C117112 is considered dangerous by lots of security experts. When this infection is active,…

2 mins ago

Generic.Dacic.304514EE.A.DDFD1BE3 removal instruction

The Generic.Dacic.304514EE.A.DDFD1BE3 is considered dangerous by lots of security experts. When this infection is active,…

18 mins ago

What is “Generic.Dacic.8952383F.A.FC3B1D52”?

The Generic.Dacic.8952383F.A.FC3B1D52 is considered dangerous by lots of security experts. When this infection is active,…

18 mins ago

Tedy.576706 removal tips

The Tedy.576706 is considered dangerous by lots of security experts. When this infection is active,…

23 mins ago

Should I remove “Malware.AI.988864385”?

The Malware.AI.988864385 is considered dangerous by lots of security experts. When this infection is active,…

33 mins ago

What is “Win32.XPaj.D.3 (B)”?

The Win32.XPaj.D.3 (B) is considered dangerous by lots of security experts. When this infection is…

38 mins ago