How to remove “Trojan-Ransom.Win32.Foreign.ndge”?

The Trojan-Ransom.Win32.Foreign.ndge is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.Foreign.ndge virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the shellcode patterns malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Attempts to modify proxy settings
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Creates known SpyNet mutexes and/or registry changes.
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan-Ransom.Win32.Foreign.ndge?

File Info:
name: A886A61B086F858AB74E.mlw
path: /opt/CAPEv2/storage/binaries/a6fad18990749ca7ddb38bd619bbb86315d4e9eb0afb1fdea620c37b8bddd340
crc32: 2F1CD45F
md5: a886a61b086f858ab74e2ebf4127ccda
sha1: 2d5175afcd89168cc7943603d79d680ac74370c3
sha256: a6fad18990749ca7ddb38bd619bbb86315d4e9eb0afb1fdea620c37b8bddd340
sha512: 2dd9356134f61ffb85548edbf40e3c80c41f936c14ea43f49b8ec9c4df6fc325f253d9e8fad18b5e2697597bfb483da32eeb6ea5523bc95f8c44e445f35109e2
ssdeep: 12288:5p9U3WtyUSpKz4/kq/L26IMVlFjq0k68c7zTY6GfIn09AlUjWM1bC:52WtyUSozmPkDGj0MM1bC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A9B4F0965A96FC64F98883F8319151E8007D2E2B8B3A4DD824D64BF7D65C3C8B4CED2D
sha3_384: d3a20600ff9ce4a9a515be4a48335bb6accbec6f224aa2009800a0cd66e832bcd4c5121caf2c2729ec423a40e1e7ae5c
ep_bytes: 558becb90b0000006a006a004975f953
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan-Ransom.Win32.Foreign.ndge also known as:

How to remove Trojan-Ransom.Win32.Foreign.ndge?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.