How to remove “Adrozek.33”?

The Adrozek.33 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adrozek.33 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates a copy of itself

How to determine Adrozek.33?

File Info:
name: CE3D5794F5E712861E48.mlw
path: /opt/CAPEv2/storage/binaries/9f828b547670ad7479977663d72bf3bc26545f23afcd7c178fe66f00280ecd87
crc32: 6702CB42
md5: ce3d5794f5e712861e481749c086af38
sha1: 733a771ff9c84778fb7b984da130cf03decbd56a
sha256: 9f828b547670ad7479977663d72bf3bc26545f23afcd7c178fe66f00280ecd87
sha512: 2ec8a05bb4dd63cfa8829406e6c2c5375ce27417b99d6e20e1fd2547856ccbcf49cc3a03ceeed3ce54ca7d2eee79d0e31ef361d4653b993cc2288b2e6b09e55e
ssdeep: 24576:p90tLgxCJ/5avFAjo6I9F5kZ8Sm+TBYU7rBRsfyHvIedknkuh7:h6UOPmaq1Oddknkuh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C6759F12F2105810E3F495344437AA5D25B07EABC72D99FB5E983DE61EF2EF089A6F01
sha3_384: 0ed402f9ee91b18553ad9a71459079c4046bea91946b5bdec221cd4705c2fef759d626404630fcb2ba0042c6d8ada540
ep_bytes: 558bec6aff6858054700688ca6460064
timestamp: 2020-10-18 14:59:13

Version Info:
CompanyName: NCT Company Ltd.
FileDescription: NCTAudioRecord2 ActiveX EXE
FileVersion: 2,5,1,130
InternalName: NCTAudioRecord2 ActiveX EXE
LegalCopyright: NCT Company Ltd. Copyright 1999 - 2003
LegalTrademarks: NCT Company Ltd.
OriginalFilename: NCTAudioRecord2.EXE
ProductName: NCTAudioRecord2 ActiveX EXE
ProductVersion: 2,5,1,130
Translation: 0x0409 0x04b0

Adrozek.33 also known as:

How to remove Adrozek.33?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.