Categories: Malware

How to remove “AdWare.Win32.ExtInstaller”?

The AdWare.Win32.ExtInstaller is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.ExtInstaller virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
A process created a hidden window
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Steals private information from local Internet browsers
Exhibits possible ransomware file modification behavior
Writes a potential ransom message to disk
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

www.cncode.pw

iplogger.org

ocsp.comodoca.com

ocsp.usertrust.com

ocsp.sectigo.com

How to determine AdWare.Win32.ExtInstaller?


File Info:
crc32: 4F17E6F8md5: 168d9415e269c57950cb232209ca804bname: 168D9415E269C57950CB232209CA804B.mlwsha1: 7b799db7e727224e1979c2c12fce41a4a21e7a70sha256: 91eeaba17a410a1189aca4c7b93612cb4749a03e8ebdeaa742018658ed1364b4sha512: 9aaba34ae175c53005b40c879eb621c809f880ee34dd76a023f56b5bb9dd6e7f5c250da6e25dfee6fbf5ae52055ecc00ea4a25ba4745dc8dcfe36236a06c96f9ssdeep: 12288:2XvtuXS3dte25VTDA1EugkQIas5tco+AqYX9TCxpwrQT5KG/SkrknF0teW:21XTU1ETJIjCC9i3WSgOtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

AdWare.Win32.ExtInstaller also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen10.39700
MicroWorld-eScan	Trojan.GenericKD.35715872
FireEye	Generic.mg.168d9415e269c579
ALYac	Trojan.GenericKD.35715872
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Adware.Win32.ExtInstaller.2!c
Sangfor	Malware
K7AntiVirus	Spyware ( 005710191 )
BitDefender	Trojan.GenericKD.35715872
K7GW	Spyware ( 005710191 )
Cybereason	malicious.5e269c
BitDefenderTheta	AI:Packer.5E5D66711F
Cyren	W32/Trojan.YFTV-0939
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
ClamAV	Win.Malware.Razy-9789744-0
Kaspersky	not-a-virus:HEUR:AdWare.Win32.ExtInstaller.gen
Alibaba	TrojanSpy:Win32/ExtInstaller.e34f17e9
ViRobot	Trojan.Win32.Z.Razy.534016.CH
Tencent	Malware.Win32.Gencirc.10ce2544
Ad-Aware	Trojan.GenericKD.35715872
Sophos	Mal/Generic-S
Comodo	Malware@#gh90x74tm68v
F-Secure	Heuristic.HEUR/AGEN.1138531
TrendMicro	TROJ_GEN.R002C0PLB20
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
Emsisoft	Trojan.GenericKD.35715872 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.PSW.Mimikatz.bis
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1138531
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Microsoft	Trojan:Win32/Glupteba!ml
Gridinsoft	Trojan.Win32.Agent.ns
Arcabit	Trojan.Generic.D220FB20
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.ExtInstaller.gen
GData	Trojan.GenericKD.35715872
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Wacatac.R358267
Acronis	suspicious
McAfee	GenericRXMM-NL!168D9415E269
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Agentb
Malwarebytes	Trojan.Dropper
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Spy.Agent.PRP
TrendMicro-HouseCall	TROJ_GEN.R002C0PLB20
Rising	Exploit.Uacbypass!1.CE04 (CLASSIC)
Yandex	PUA.ExtInstaller!BBW86/bkuZQ
Ikarus	Trojan-Spy.Agent
Fortinet	W32/Agent.PRP!tr
AVG	Win32:RATX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Virus.Adware.e58