AdWare.Win32.Vopak.clly removal instruction

The AdWare.Win32.Vopak.clly is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Vopak.clly virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Reads data out of its own binary image
Authenticode signature is invalid
Collects information to fingerprint the system

Related domains:

cmi.ironbeast.io

wpad.local-net

How to determine AdWare.Win32.Vopak.clly?


File Info:
name: FB1EDE83AC3C3494DB3E.mlw
path: /opt/CAPEv2/storage/binaries/64a88b31332b62485d1fc3815b5586c0d9a13a1454fbc07255daa2d1acc769ad
crc32: EED55B4D
md5: fb1ede83ac3c3494db3e5deb791c63f9
sha1: c159910196778eff10c9f33fe8da5c488188b2c2
sha256: 64a88b31332b62485d1fc3815b5586c0d9a13a1454fbc07255daa2d1acc769ad
sha512: 5ae421e247b212a0ca9f602bf856188a361373bdc2c17de4cc2e8f81df2680253f1a8f029028b821577db55d2b94720d0b2f28a09bf9996817174d9121a15488
ssdeep: 6144:HkrlM9sWhEhbiLd/XE573m03HxlB4m62+PPR6HXnktbr:sEsfbSd/UL3B4mvOPR2XnktX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11B44121225F77E87E5D7733100BBD73AEBB7C54414209A271B108E692D2B786DA2B383
sha3_384: 8e9cdfb1b65bdee557676be4fd5393a5870fd9cc897c39bece996e7fbb7fcbe3d37a5198730e7cb00ba4e5274eba3b4c
ep_bytes: 81ec8401000053565733db6801800000
timestamp: 2016-07-25 00:55:35

Version Info:
0: [No Data]

AdWare.Win32.Vopak.clly also known as:

Lionic	Adware.Win32.Vopak.2!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.fb1ede83ac3c3494
McAfee	Artemis!FB1EDE83AC3C
Cylance	Unsafe
Sangfor	Trojan.Win32.Heuristic.rg
Alibaba	AdWare:Win32/ConvertAd.5baa3bf7
Cybereason	malicious.196778
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Adware.ConvertAd.AJU.gen
APEX	Malicious
Paloalto	generic.ml
Kaspersky	not-a-virus:AdWare.Win32.Vopak.clly
SUPERAntiSpyware	Adware.ConvertAd/Variant
Avast	NSIS:ConvertAd-AL [Adw]
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PKL21
McAfee-GW-Edition	BehavesLike.Win32.Vopak.dc
Sophos	Generic PUA MB (PUA)
Jiangmin	AdWare.PriceGong.an
Avira	HEUR/AGEN.1116901
Kingsoft	Win32.Troj.Vopak.cl.(kcloud)
Arcabit	PUP.Adware.ConvertAd
Microsoft	Trojan:Win32/Wacatac.A!ml
Acronis	suspicious
VBA32	suspected of Trojan.Downloader.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0PKL21
Tencent	Win32.Adware.Convertad.Ecty
SentinelOne	Static AI – Malicious PE
AVG	NSIS:ConvertAd-AL [Adw]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (D)

How to remove AdWare.Win32.Vopak.clly?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

AdWare.Win32.Vopak.clly removal instruction