Categories: Malware

What is “AdWare.Win32.MegaSearch.am”?

The AdWare.Win32.MegaSearch.am is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.MegaSearch.am virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to create or modify a Browser Helper Object
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine AdWare.Win32.MegaSearch.am?


File Info:
name: C3067E69190C9AEA37FF.mlwpath: /opt/CAPEv2/storage/binaries/012982e04c68580c5b1877528d8799c96e0c9294f452dcae84a9e18675fa7985crc32: BDC463FCmd5: c3067e69190c9aea37ffc893b308cd6esha1: 3df4bc287c4e89dccc69d954990dc43f35099ed9sha256: 012982e04c68580c5b1877528d8799c96e0c9294f452dcae84a9e18675fa7985sha512: c2e1b237c28141efb57e5b8f96c85a5903503e9af9331f9876995d4091218130a8053a58d59cfc909996a894abba02c84a6b008143bd482415dc73d598223128ssdeep: 6144:h1OgDPdkBAFZWjadD4s5aKBkdN/SKV94EIDj/bCqit7d:h1OgLdaOackdhV94jXb4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E544D1213AE1C8FAD2920432CE647FD5E2F9D6540F31887733D94A1D2F7D985C22AB5Asha3_384: 403970f5d845a5edac1b4e01ab872b4cec43658028d9e20fc4a00aa784b76fc32749476f1f4ddc8835118e1a6e290dcaep_bytes: 558bec6aff68e0b94100682c4a410064timestamp: 2010-11-18 16:27:35
Version Info:
CompanyName: Igor PavlovFileDescription: 7z Setup SFXFileVersion: 9.20InternalName: 7zS.sfxLegalCopyright: Copyright (c) 1999-2010 Igor PavlovOriginalFilename: 7zS.sfx.exeProductName: 7-ZipProductVersion: 9.20Translation: 0x0409 0x04b0

AdWare.Win32.MegaSearch.am also known as:

Bkav	W32.AIDetectMalware
Lionic	Adware.Win32.MultiPlug.2!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Adware.JS.MultiPlug.A
FireEye	Generic.mg.c3067e69190c9aea
CAT-QuickHeal	Diplugem.JS.A
Skyhigh	BehavesLike.Win32.Downloader.dc
McAfee	Downloader-FLN
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
Alibaba	AdWare:Script/MegaSearch.a2942da0
CrowdStrike	win/grayware_confidence_100% (W)
VirIT	Adware.Win32.Plugin.P
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
TrendMicro-HouseCall	ADW_MULTIPLUG
Avast	JS:Browsermodifier-B [Trj]
ClamAV	Legacy.Trojan.Trojan-1039
Kaspersky	not-a-virus:AdWare.Win32.MegaSearch.am
BitDefender	Dropped:Adware.JS.MultiPlug.A
NANO-Antivirus	Riskware.Script.Plugin.cjvvyt
Tencent	Win32.Script.Agent.Lzfl
Sophos	Generic Reputation PUA (PUA)
F-Secure	Malware.JS/MPlug.PR
DrWeb	JS.Plugin.13
VIPRE	Dropped:Adware.JS.MultiPlug.A
TrendMicro	ADW_MULTIPLUG
Trapmine	malicious.high.ml.score
Emsisoft	Dropped:Adware.JS.MultiPlug.A (B)
Ikarus	PUA.Monetizer.Gen7
Jiangmin	AdWare.Script.q
ALYac	Dropped:Adware.JS.MultiPlug.A
Varist	JS/MPlug.A
Avira	ADWARE/Adware.Gen7
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	Win32.Troj.MegaSearch.am
Microsoft	BrowserModifier:Win32/Diplugem
Xcitium	Application.Win32.Multiplug.D@4rev5n
Arcabit	Adware.JS.MultiPlug.A
ZoneAlarm	not-a-virus:HEUR:AdWare.Script.Generic
GData	Win32.Trojan.Multiplug.E
Cynet	Malicious (score: 100)
VBA32	Adware.MultiPlug
Google	Detected
Cylance	unsafe
Panda	Trj/CI.A
Rising	Adware.ScrInject!1.CF70 (CLASSIC)
Yandex	PUA.Agent!oLP4FA1o/W4
MaxSecure	Adware.JS.MultiPlug.P
Fortinet	Adware/MultiPlug
AVG	JS:Browsermodifier-B [Trj]
Cybereason	malicious.9190c9
DeepInstinct	MALICIOUS
alibabacloud	AdWare:Win/MultiPlug.I