Adware

Adware.NSIS.AdPack removal guide

Malware Removal

The Adware.NSIS.AdPack is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Adware.NSIS.AdPack virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Anomalous file deletion behavior detected (10+)
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Enumerates running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Collects information about installed applications
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Created a service that was not started

How to determine Adware.NSIS.AdPack?


File Info:

name: 9B5461FEFA57CD53A9EB.mlw
path: /opt/CAPEv2/storage/binaries/8c99792994fb40e3366ce8d7e3a91f222d906c1997483fa12e185ba7a1c15cc9
crc32: 86D42973
md5: 9b5461fefa57cd53a9eb93b92d82f386
sha1: 10f2e8fe0148501fdc62ed07599a15007e7d6418
sha256: 8c99792994fb40e3366ce8d7e3a91f222d906c1997483fa12e185ba7a1c15cc9
sha512: d4352679e4557ee61e6112e4a3631f83713b5b39a4da509ce80a62bae5f614ccb9750f177ebf4919d79c0ac09945aaec697dacee63bf9d01c3673a6e32343646
ssdeep: 98304:jYsc6t5j3+w8+ybUAE33muAUpyYZ1NjY/:jYsc6baKZHmuzyY+/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19D063316F6A64F8FFC5785F00050EC7B0AE32E021577634B6F417B8EA9F4A86A158F19
sha3_384: 96544d1a7111786a3adda0bd811ea063606763b3e1a244a4ff45795f939c5b02aa48a00b04c7471c6a9d4d2cf4d3cf93
ep_bytes: 81ecd40200005356576a205f33db6801
timestamp: 2019-12-16 00:54:10

Version Info:

Comments:
CompanyName: CrystalIdea Software
FileDescription: Uninstall Tool v3.6.0.5684
FileVersion: 3.6.0.5684
LegalCopyright: © CrystalIdea Software
ProductName: Uninstall Tool v3.6.0.5684
Translation: 0x0409 0x04b0

Adware.NSIS.AdPack also known as:

LionicAdware.NSIS.AdPack.2!c
McAfeeArtemis!9B5461FEFA57
CylanceUnsafe
Elasticmalicious (high confidence)
APEXMalicious
CynetMalicious (score: 100)
Kasperskynot-a-virus:UDS:AdWare.NSIS.AdPack.gen
AvastWin32:Adware-gen [Adw]
ZillyaAdware.AdPack.Win32.195
McAfee-GW-EditionBehavesLike.Win32.Dropper.wc
FireEyeGeneric.mg.9b5461fefa57cd53
SophosGeneric PUA BA (PUA)
JiangminTrojan.Generic.gwsls
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
VBA32Adware.NSIS.AdPack
RisingAdware.AdPack/NSIS!8.13A99 (CLOUD)
IkarusTrojan.Win32.Adrepack
AVGWin32:Adware-gen [Adw]

How to remove Adware.NSIS.AdPack?

Adware.NSIS.AdPack removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment