About “AdWare.Win32.PCAppStore” infection

The AdWare.Win32.PCAppStore is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.PCAppStore virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Behavioural detection: Injection (inter-process)
• Detects Bochs through the presence of a registry key
• Checks the version of Bios, possibly for anti-virtualization
• Checks the CPU name from registry, possibly for anti-virtualization
• Attempts to modify proxy settings
• Accessed credential storage registry keys
• Deletes executed files from disk
• Collects information to fingerprint the system

How to determine AdWare.Win32.PCAppStore?

File Info:
name: 4D94E6DF58667006C526.mlw
path: /opt/CAPEv2/storage/binaries/3ea3eb5edecfc2e04589bf5aee66c7d046a265e1d9d1b4ea2bd05e0e17b7908a
crc32: 0797F33D
md5: 4d94e6df58667006c5269713a103760a
sha1: 3720dbae40e2e5a74ba65bd588e3b1915f8869e6
sha256: 3ea3eb5edecfc2e04589bf5aee66c7d046a265e1d9d1b4ea2bd05e0e17b7908a
sha512: a51ecfa816fbb7a0f5449689b5441512248e46c30e1fc4b21b0a05ce46020b55555ffbc21b4a388b88f6b44cf0162b7b18652daf12324c280659157117b56350
ssdeep: 1536:N/T2X/jN2vxZz0DTHUpou08xuIr5Mdv0xE+1zyYCDtpXOr678ux:NbG7N2kDTHUpou0suv0Pzy5n+G
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15BA3AE10B750C4A2F8A3CB30246492365A79AC21F5A04B4F3FD05A596ADE3F19F2E3E5
sha3_384: b96dad7e7afc7dabfa650033ac72f79d09b42a8a27248065c5ce494b8df547ea1ca05be4a8264c6e5a0920ebdaf9065c
ep_bytes: 558bec81ecf40300005356576a205f33
timestamp: 2021-09-25 21:57:46

Version Info:
0: [No Data]

AdWare.Win32.PCAppStore also known as:

How to remove AdWare.Win32.PCAppStore?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.