Categories: RansomTrojan

TrojanRansom.Petr removal instruction

The TrojanRansom.Petr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanRansom.Petr virus can do?

Executable code extraction
Possible date expiration check, exits too soon after checking local time
Creates RWX memory
Drops a binary and executes it
Uses Windows utilities for basic functionality
Attempts to restart the guest VM
Installs itself for autorun at Windows startup
Unusual version info supplied for binary

How to determine TrojanRansom.Petr?


File Info:
crc32: 495873BBmd5: 2b82f4dfcfbf40f412e0302d2bcaf21fname: 2B82F4DFCFBF40F412E0302D2BCAF21F.mlwsha1: 947799d1fd5a5f8de888c831a2d833da2f6d0809sha256: 8f43e8da6b189e9295ba059cd9771edb32b2d42e77efe9e80f783c83ef847b55sha512: 25e4974390ac7a2a46f7c785969dae14242e027eb37e1fb50000cb2e2bbd9d3b896aebad1a7654afe9da3bc4c7ab4afdb5a7d2e5dfb27ecedbe676359da15c65ssdeep: 1536:BzW+UWvxY9Qgu9iLoLSGnH/Ss5gpZRWWjILJggc3M8ZCMzbcJyeI0Ti:BzW+DiC9iLo+GnH/75QZRWzgbVrITtype: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.InternalName: Wextract                FileVersion: 8.00.7600.16385 (win7_rtm.090713-1255)CompanyName: Micwosofwt CwooperashawnProductName: Windowsxae Internet ExplorerProductVersion: 8.00.7600.16385FileDescription: Wyndowz Updat                                          OriginalFilename: WEXTRACT.EXE            .MUITranslation: 0x0409 0x04b0

TrojanRansom.Petr also known as:

K7AntiVirus	Trojan ( 004e19001 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen7.57150
Cynet	Malicious (score: 99)
Cylance	Unsafe
Zillya	Adware.Generic.Win32.65888
Alibaba	Ransom:Win32/Petya.a6f91b54
K7GW	Trojan ( 004e19001 )
Cybereason	malicious.1fd5a5
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Diskcoder.Petya.A
APEX	Malicious
Avast	MBR:Ransom-C [Trj]
Kaspersky	Trojan-Ransom.Win32.Petr.aqv
NANO-Antivirus	Trojan.Win32.Diskcoder.fhbqwx
Tencent	Win32.Trojan.Petr.Htck
Sophos	Generic PUA JE (PUA)
Comodo	Malware@#3eje6125c5l5x
McAfee-GW-Edition	BehavesLike.Win32.Ardurk.ch
FireEye	Generic.mg.2b82f4dfcfbf40f4
SentinelOne	Static AI – Suspicious SFX
Jiangmin	AdWare.Generic.svgg
Avira	TR/Dropper.Gen
Microsoft	Ransom:Win32/Petya.A
AegisLab	Trojan.Win32.Petr.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
McAfee	Artemis!2B82F4DFCFBF
MAX	malware (ai score=100)
VBA32	TrojanRansom.Petr
Malwarebytes	Malware.Heuristic.1001
Panda	Trj/CI.A
Rising	Ransom.Petya!8.48D7 (CLOUD)
Yandex	Trojan.Petr!4LisUKgEc2E
Ikarus	Trojan-Downloader.Win32.Banload
Fortinet	W32/Petya.A!tr.ransom
AVG	MBR:Ransom-C [Trj]
Qihoo-360	Win32/Ransom.Generic.HwYDEpsA