Adware.Hiru removal instruction

The Adware.Hiru is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Adware.Hiru virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Reads data out of its own binary image
Authenticode signature is invalid

How to determine Adware.Hiru?


File Info:
name: 7493A9D26A7817CFFC55.mlw
path: /opt/CAPEv2/storage/binaries/c8ce48069f83b223cbadc96620f694418fa0135623d43c3b83fdce8a3d80e7fd
crc32: BB98683B
md5: 7493a9d26a7817cffc55cf66aa1af731
sha1: 10e49ce1c9b8db2cd5f51898828f8b5c2ae289a0
sha256: c8ce48069f83b223cbadc96620f694418fa0135623d43c3b83fdce8a3d80e7fd
sha512: d4f611e3bc128cd727518abe03e45b496f984f7e50f15a11c811d29c04a0f1f0c6e9d1b3daf59226f066bf7bff9a185459985a3414ee7e334a43b8e60611f617
ssdeep: 98304:VlzXdsn2PVAraFg8OKPXHPt71to7QvTceRJqxOCHmsvMksgVesO:xsn2tAraFg8Xvt71to7QvQMJqxOCjvI1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T164063309C0A0281BD1CEDC79C7FBB94F5A7733B16E70CE48C72B1A9939A136A7515E06
sha3_384: 54e5d3d90b50e624c6205e0a889979b0d9c1841acfcc6aaa7115c8f4fe6f5d45e47d9eb4ce3878932000921d9b22a215
ep_bytes: 81ecd4020000535556576a2033ed5e89
timestamp: 2012-02-24 19:19:59

Version Info:
Comments: 
CompanyName: KpoJIuK
FileDescription: Adobe Installer
FileVersion: 1.0.0.0
LegalCopyright: © KpoJIuK
ProductName: Adobe Installer
Translation: 0x0000 0x0000

Adware.Hiru also known as:

Bkav	W32.AIDetect.malware1
Lionic	Riskware.Win32.Ursu.1!c
CAT-QuickHeal	Trojan.Ursu
McAfee	Artemis!7493A9D26A78
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RiskWare.HackTool.Agent.N
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Ursu-6952027-0
Rising	Trojan.Generic@ML.84 (RDMK:dnwBrnq5NJDls4VKH9+7WQ)
Sophos	Generic ML PUA (PUA)
Comodo	Malware@#3rm3ewosxp0py
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Webroot	W32.Malware.Gen
Gridinsoft	Ransom.Win32.Occamy.sa
Microsoft	Trojan:Win32/Occamy.CC8
AhnLab-V3	Adware/Win32.Hiru.C2927521
VBA32	Adware.Hiru
Malwarebytes	Trojan.Agent
TrendMicro-HouseCall	TROJ_GEN.R06CH0CF821
Tencent	Trojan.Win32.BitCoinMiner.la
Yandex	RiskWare.HackTool!8i2OA569Y9o
Ikarus	PUA.RiskWare.Hacktool
Fortinet	Riskware/HackTool_Agent
Panda	Trj/CI.A

How to remove Adware.Hiru?

Adware.Hiru removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X