Win32:Ransom-FH [Trj] removal instruction

The Win32:Ransom-FH [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Ransom-FH [Trj] virus can do?

Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:Ransom-FH [Trj]?


File Info:
name: 56BD6E2BD4734A2C0EB4.mlw
path: /opt/CAPEv2/storage/binaries/5a9228bcce035e9db194e9da8d5bfa3f9f1e8b80dc379721d83c030825278247
crc32: 97F99EFB
md5: 56bd6e2bd4734a2c0eb45a69d577116f
sha1: 4cecfc51648af5084c4642eab6abd64260235dd9
sha256: 5a9228bcce035e9db194e9da8d5bfa3f9f1e8b80dc379721d83c030825278247
sha512: ac6df3bc4f06504cefa98124ca35d5999c0a6b4f2fc5d18a4106462b66b25ee3c374480fd0aec9a25da718e5c91bd0a3d4a9349df77f2ba2a0f4389836cbd10e
ssdeep: 768:Qog744p8J98qKu6I+qHjN68K8GBJOgeUyc3xhkn/810VUg:QoqDNI+MjN68K8gJOgeUyc3xhk/810Vj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T181F2632A77058931F5A941744046A07179212D36BEC9CA0EEB47EF7EA87C64BB3F460B
sha3_384: 386ed8048b7a0748c38e5018b682118ed1d386e72894d7504bf1ecdb81d081a14b6d54c1342f8b7974650c6c29612e29
ep_bytes: 68a4164000e8f0ffffff000000000000
timestamp: 2011-08-14 15:50:09

Version Info:
0: [No Data]

Win32:Ransom-FH [Trj] also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Adware.GenericKD.38901311
FireEye	Generic.mg.56bd6e2bd4734a2c
McAfee	Artemis!56BD6E2BD473
Sangfor	Ransom.Win32.Xorist.cx
K7AntiVirus	Trojan ( 002fee551 )
Alibaba	Ransom:Win32/Xorist.a550ea53
K7GW	Trojan ( 002fee551 )
Cybereason	malicious.1648af
Cyren	W32/Damaged_File.E.gen!Eldorado
Symantec	Trojan.Gen.MBT
Paloalto	generic.ml
Kaspersky	Trojan-Ransom.Win32.Xorist.cx
BitDefender	Adware.GenericKD.38901311
NANO-Antivirus	Trojan.Win32.Xorist.covjyg
APEX	Malicious
Sophos	Mal/Generic-S
DrWeb	Trojan.PWS.Siggen.31370
McAfee-GW-Edition	BehavesLike.Win32.Duptwux.nt
Ikarus	Backdoor.Win32.Ruskill
Jiangmin	Trojan/Generic.omuj
MAX	malware (ai score=60)
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	Ransom:Win32/Genasom.FN
ZoneAlarm	Trojan-Spy.Win32.Zbot.wsid
GData	Adware.GenericKD.38901311
Cynet	Malicious (score: 100)
Avast	Win32:Ransom-FH [Trj]
Rising	Ransom.Xorist!8.4A0 (CLOUD)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/VBKrypt.BBBQ!tr
AVG	Win32:Ransom-FH [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32:Ransom-FH [Trj]?

Win32:Ransom-FH [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X