Ransom Trojan

How to remove “Trojan-Ransom.Win32.GenericCryptor.fpo”?

Malware Removal

The Trojan-Ransom.Win32.GenericCryptor.fpo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.GenericCryptor.fpo virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Compression (or decompression)
  • Creates RWX memory
  • Reads data out of its own binary image
  • Attempts to modify desktop wallpaper
  • Executed a process and injected code into it, probably while unpacking
  • Exhibits behavior characteristic of Cerber ransomware
  • Attempts to execute a binary from a dead or sinkholed URL
  • Writes a potential ransom message to disk
  • Attempts to access Bitcoin/ALTCoin wallets
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

How to determine Trojan-Ransom.Win32.GenericCryptor.fpo?


File Info:

crc32: 13E394BE
md5: eb3c4aa08fb4ced78e27d73e65cffcb0
name: EB3C4AA08FB4CED78E27D73E65CFFCB0.mlw
sha1: ce58ce67b4f59c26a3e9e191a431a1983468d39a
sha256: 29a64746c2b44cfb3625484935352f2a0a4ba7fc446f8dc5b185d4ee32b54da9
sha512: ea551f5e94048efef30aadc915ac468e7c8e9b935157021dd2bfebe4caa4128b22757cb3c8cec3bf8d03b400d6a7ef5467f3f70bb483368142c296dd89cae2fb
ssdeep: 6144:H28A9M4yEoeNjYS4rhvjHUWXgNYDXg/JWG+P:W8LLEoeRyjHM/J/+P
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:

0: [No Data]

Trojan-Ransom.Win32.GenericCryptor.fpo also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 00508a731 )
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.10464
CynetMalicious (score: 100)
ALYacTrojan.GenericKD.4654538
CylanceUnsafe
ZillyaTrojan.GenericKD.Win32.95747
SangforRansom.Win32.Cerber.rfn
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:Win32/Cerber.cbd9acc8
K7GWTrojan ( 00508a731 )
Cybereasonmalicious.08fb4c
CyrenW32/Injector.NYRS-5646
ESET-NOD32multiple detections
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Ransomware.Cerber-6987217-0
KasperskyTrojan-Ransom.Win32.GenericCryptor.fpo
BitDefenderTrojan.GenericKD.4654538
NANO-AntivirusTrojan.Win32.DMLV.emobin
MicroWorld-eScanTrojan.GenericKD.4654538
TencentWin32.Trojan.Genericcryptor.Akoy
Ad-AwareTrojan.GenericKD.4654538
SophosMal/Generic-R + Mal/Cerber-Z
ComodoMalware@#36hsqv16c58w6
BitDefenderThetaGen:NN.ZedlaF.34608.bq4@ayuSWno
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_CERBER.F117CH
McAfee-GW-EditionBehavesLike.Win32.ICLoader.dc
FireEyeGeneric.mg.eb3c4aa08fb4ced7
EmsisoftTrojan.GenericKD.4654538 (B)
SentinelOneStatic AI – Suspicious PE
WebrootW32.Ransom.Gen
AviraHEUR/AGEN.1116898
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftRansom:Win32/Cerber!rfn
ArcabitTrojan.Generic.D4705CA
AegisLabTrojan.Win32.GenericCryptor.4!c
GDataTrojan.GenericKD.4654538
TACHYONRansom/W32.Cerber.236148
AhnLab-V3Trojan/Win32.Cerber.R196732
McAfeeArtemis!EB3C4AA08FB4
MAXmalware (ai score=83)
VBA32BScope.TrojanRansom.Cerber
MalwarebytesMalware.AI.3708405053
PandaTrj/CI.A
TrendMicro-HouseCallRansom_CERBER.F117CH
RisingRansom.Cerber!8.3058 (CLOUD)
YandexTrojan.Injector!AvG1Pk/B1+s
IkarusTrojan-Ransom
FortinetW32/Cerber.230F!tr.ransom
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.Generic.HyoDyz8A

How to remove Trojan-Ransom.Win32.GenericCryptor.fpo?

Trojan-Ransom.Win32.GenericCryptor.fpo removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment