Adware

Adware.ICLoader removal guide

Malware Removal

The Adware.ICLoader is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Adware.ICLoader virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Queries information on disks, possibly for anti-virtualization
  • Behavior consistent with a dropper attempting to download the next stage.
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
static.133.1.203.116.clients.your-server.de

How to determine Adware.ICLoader?


File Info:

crc32: BFC62739
md5: c339c8c591c902efd803ad56f1aabf47
name: cheat.exe
sha1: bf94247b3f607794d5bbe4f295d1e8ca5ced8b32
sha256: 38db7683a3f2057d97684f77ac4045c1e8279086d9e7493624877734d709e7e3
sha512: 0e353d57738931fba87ef4351b1435459dff234830c5e53d4f84a4ce1ffd877f0c8bcfb872002ee47e44e0e73dfc0cd14f72e3cf4f798a028ed508032ebfbcb4
ssdeep: 24576:MbF7ev/PLLDqwX2XJw2PHmFrljSxjLaE+akztuew1544Xu3pPsT:M4XjawX0JfClEJ3gue94+3RG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Adware.ICLoader also known as:

MicroWorld-eScanTrojan.Generic.23264391
CAT-QuickHealTrojan.Ekstak
McAfeeICLoader!C339C8C591C9
MalwarebytesAdware.ICLoader
ZillyaTrojan.Ekstak.Win32.18649
BitDefenderTrojan.Generic.23264391
K7GWTrojan ( 00543e021 )
K7AntiVirusTrojan ( 005452be1 )
TrendMicroTROJ_GEN.R060C0OLJ18
NANO-AntivirusVirus.Win32.Gen.ccmw
CyrenW32/S-11974717!Eldorado
SymantecML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R060C0OLJ18
Paloaltogeneric.ml
GDataTrojan.Generic.23264391
KasperskyTrojan.Win32.Ekstak.ljgu
RisingTrojan.Kryptik!1.AA23 (CLOUD)
Ad-AwareTrojan.Generic.23264391
SophosGeneric PUA LP (PUA)
ComodoApplicUnwnt@#1m3zrxsgu21lb
F-SecureTrojan.Generic.23264391
DrWebTrojan.InstallCube.3825
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Generic.th
Trapminemalicious.high.ml.score
EmsisoftTrojan.Generic.23264391 (B)
F-ProtW32/S-11974717!Eldorado
JiangminTrojan.Ekstak.wrj
WebrootW32.Trojan.Gen
AviraPUA/ICLoader.Gen8
Antiy-AVLTrojan/Win32.Ekstak
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D162FC87
ZoneAlarmTrojan.Win32.Ekstak.ljgu
MicrosoftTrojan:Win32/Occamy.C
AhnLab-V3PUP/Win32.ICLoader.C2897142
Acronissuspicious
VBA32TScope.Malware-Cryptor.SB
ALYacTrojan.Generic.23264391
CylanceUnsafe
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.GNVZ
TencentWin32.Trojan.Ekstak.Svqv
YandexTrojan.Ekstak!
SentinelOnestatic engine – malicious
FortinetW32/GenKryptik.CTDK!tr
AVGWin32:AdwareX-gen [Adw]
Cybereasonmalicious.591c90
AvastWin32:AdwareX-gen [Adw]
CrowdStrikemalicious_confidence_80% (W)
Qihoo-360Win32/Virus.835

How to remove Adware.ICLoader?

Adware.ICLoader removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment