Adware.RussAd information

The Adware.RussAd is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware.RussAd virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Reads data out of its own binary image
Drops a binary and executes it
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

vkdj.org

How to determine Adware.RussAd?


File Info:
crc32: 9188C765
md5: 450cbaf5a2b66d07f4d2ea6563f0b076
name: 450CBAF5A2B66D07F4D2EA6563F0B076.mlw
sha1: 3c925c291ebb3c4df26858cd2eb15352f3d75178
sha256: bdcdcf0aa3c55b1871be89bee4ac0c97ff8a8ace19e4ee71681a6d783fea325d
sha512: b6cdccf08a53bd98e536c766cbffcab692df817c40ddf73e98328bb6a4a825b842afc2fa384d5d8740d4d21f1c9bcdbcd3ed697f126aae78f54706487d1e6c4b
ssdeep: 49152:VqeNV/O5iBNwJiiZQCu9f0BTHgXhfSUx7:kEFOwjggJ0ZgXxxx7
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright:                                                                                                     
FileVersion: 1.2.02.3            
CompanyName: vkx43enatktx435_DJ                                                
Comments: This installation was built with Inno Setup.
ProductName: x412x43aox43dx430x442x43ax442ex414x438x434x435x436x439                                             
ProductVersion: 1.00075153                                        
FileDescription: x412x43aox43dx430x442x43ax442ex414x438x434x435x436x439 Setup                                       
OriginalFileName:                                                   
Translation: 0x0000 0x04b0

Adware.RussAd also known as:

K7AntiVirus	Adware ( 00570af31 )
DrWeb	Program.VKontakteDJ.112
McAfee	Artemis!450CBAF5A2B6
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Adware ( 00570af31 )
Cyren	W32/VKontakte.E.gen!Eldorado
Symantec	Ransom.Hermes!gen2
ESET-NOD32	a variant of Win32/Yandex.K potentially unwanted
APEX	Malicious
Avast	FileRepMalware
Kaspersky	HEUR:Trojan-Dropper.Win32.Pasnaino.gen
BitDefender	Gen:Variant.Midie.84157
MicroWorld-eScan	Gen:Variant.Midie.84157
Ad-Aware	Gen:Variant.Midie.84157
Sophos	VKontakteDJ (PUA)
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
FireEye	Gen:Variant.Midie.84157
Emsisoft	Gen:Variant.Midie.84157 (B)
Avira	HEUR/AGEN.1138705
Microsoft	Trojan:Script/Phonzy.A!ml
Arcabit	Trojan.Midie.D148BD
GData	Gen:Variant.Midie.84157
AhnLab-V3	Malware/Win.Generic.R423296
MAX	malware (ai score=85)
Malwarebytes	Adware.RussAd
TrendMicro-HouseCall	TROJ_GEN.R067H0CFO21
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/VKDJ.B!tr
AVG	FileRepMalware
Qihoo-360	Win32/TrojanDropper.Generic.HgIASWUA

How to remove Adware.RussAd?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.