About “VBRansom.1 (B)” infection

The VBRansom.1 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VBRansom.1 (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine VBRansom.1 (B)?

File Info:
name: 592E5999C92404EF68E7.mlw
path: /opt/CAPEv2/storage/binaries/d17bb7a4a12885a302601892eb05c18fe557d4218c7e2a89d8b9e88fc2e2854a
crc32: E86F4039
md5: 592e5999c92404ef68e707f9fecca9ab
sha1: 8af76152d510740670e6ac1fa5c361a1c8184876
sha256: d17bb7a4a12885a302601892eb05c18fe557d4218c7e2a89d8b9e88fc2e2854a
sha512: 8fb3b89ca481b12fe98a606689fe8460aa0009b3489e9772e594f924dd9446cc20a50f90dee2743558a9dea05724f48e210584fe213e9ad4c653d955267bbfb1
ssdeep: 1536:rgBZyzgzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4/F:y8QW6cOadGRJuH7ut/Tdvd+hXV/vU3vk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T144A3812B778010D3D51852B92DD3B3C715B272851A2739831A2027AAED66F411B7EAFF
sha3_384: b9f6a0b2e9af7cd65911ebbc4cfbbc9004fe7fe4ce761129cbdad6006a73e5e05e1d5a5f05368fa8d0dce8231eda8544
ep_bytes: 6848134000e8eeffffff000000000000
timestamp: 2011-02-16 16:33:27

Version Info:
Translation: 0x0409 0x04b0
ProductName: nOoYxuMSPMTypaTbcoN
FileVersion: 2.59
ProductVersion: 2.59
InternalName: QJUcIAc
OriginalFilename: QJUcIAc.exe

VBRansom.1 (B) also known as:

How to remove VBRansom.1 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.