Adware.AdUpdater malicious file

The Adware.AdUpdater is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware.AdUpdater virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Created a process from a suspicious location
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

wpad.local-net

filedn.com

How to determine Adware.AdUpdater?


File Info:
name: A30DD3C40AB87EDC6686.mlw
path: /opt/CAPEv2/storage/binaries/998cff9c46dea4ecca041199a52873cccad45f59d192d68c455b1744990693c0
crc32: F4B86F41
md5: a30dd3c40ab87edc668667f6e52bfbd7
sha1: 3d536b9447fd6cbfcf122ba4417fb47aee74929c
sha256: 998cff9c46dea4ecca041199a52873cccad45f59d192d68c455b1744990693c0
sha512: 1deca926809cd99bfe02ca871832d673c4b9b6a5c06bc4ab75771c2c8264a9d397bd04be40b0d973c87d61b270145f573ff7925aa6802c71afd519b9a9b3a82f
ssdeep: 24576:nzBIWcmjuRli1R/zBUhmgI2TIhXlqLUxocktXo4SHS1CQAHgxs/r65K8noz0W6vQ:tIWcmKRklqdTAqwxSXo4SHS1Fsl8E0j4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10F851202F293C072D4A50475053A9BB68F767D7167A4C0E7AFE439A89E323D1A73634B
sha3_384: 9448ecf93b7630c19fc31e6c38bdf2728c7dd97b2b9417fc9229e3cee2784c49145a63beff61c38f8bb3a8203999494e
ep_bytes: e8a61d0000e989feffff8bff565733f6
timestamp: 2019-01-03 19:13:08

Version Info:
Comments: Created with Setup Factory
FileDescription: Setup Application
FileVersion: 9.5.3.0
InternalName: suf_launch
LegalCopyright: Setup Engine Copyright © 2004-2019 Indigo Rose Corporation
LegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFilename: suf_launch.exe
ProductName: Setup Factory Runtime
ProductVersion: 9.5.3.0
Translation: 0x0409 0x04e4

Adware.AdUpdater also known as:

Lionic	Trojan.Win64.Microleaves.h!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoad4.14552
Cynet	Malicious (score: 100)
FireEye	Generic.mg.a30dd3c40ab87edc
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0056d9611 )
K7GW	Trojan ( 0056d9611 )
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Proxy.Win64.Microleaves.gen
SUPERAntiSpyware	Trojan.Agent/Gen-Indiloadz
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Ikarus	Trojan.Win32.Indiloadz
Gridinsoft	Ransom.Win32.Wacatac.sa
ViRobot	Trojan.Win32.Z.Indiloadz.1839378.CB
AhnLab-V3	Trojan/Win.Generic.C4606056
McAfee	Artemis!A30DD3C40AB8
VBA32	Adware.AdUpdater
Malwarebytes	Adware.IndiLoadz
TrendMicro-HouseCall	TROJ_GEN.R002H07KN21
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.119942019.susgen
Fortinet	Riskware/Indiloadz

How to remove Adware.AdUpdater?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Adware.AdUpdater malicious file