Should I remove “Adware.Zzinfor”?

The Adware.Zzinfor is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware.Zzinfor virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Attempts to modify browser security settings
• Attempts to disable browser security warnings
• Harvests cookies for information gathering
• The sample wrote data to the system hosts file.

How to determine Adware.Zzinfor?

File Info:
name: 74D5FEDD6CDC188F46EB.mlw
path: /opt/CAPEv2/storage/binaries/eb345c1e844b216988cd7558349e5856ee891db55d16be4815fb3a430d5d9106
crc32: 15531A5D
md5: 74d5fedd6cdc188f46ebb9153f0b6e86
sha1: 1e775fa3f0f95fbe2a0578bb75bbbe950e3e3b55
sha256: eb345c1e844b216988cd7558349e5856ee891db55d16be4815fb3a430d5d9106
sha512: 1d4abb82f1308da17c192073e5485dd72e1d4f03d8e9ef4d2f8d24dbfca8ba9bbca92940a6b23b28518298bfea23d7e183da360fc604658cc3ec257dcfabdbf2
ssdeep: 12288:9Ei1swyOlCo/ZP7/8AHikvd0Vf5xFmPyULDCkBR6eeb3MJrs3MJrhd/:9H1JzlF/V7kAHi6dgxFvUhBR60rzrz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C4458C0576A0C1B2C2E96D305DA6FB706EBEAC745D395A5336C83B6E3E710815E28D0F
sha3_384: 69ac24777be1d63b273ccb0f5284ef138e3f729577d73d86ad38c1ceb4bd668b071b769cbcd13f8d8adf182b8bf799af
ep_bytes: e82db30000e978feffffcccccccccccc
timestamp: 1970-01-01 03:33:12

Version Info:
Comments: IE_FREAME
FileDescription: pulic
FileVersion: 1, 5, 8, 1312
ProductName: IE_FREAME
ProductVersion: 0, 0, 0, 1
Translation: 0x0804 0x03a8

Adware.Zzinfor also known as:

How to remove Adware.Zzinfor?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.