Malware

Application.AdBundle (A) removal instruction

Malware Removal

The Application.AdBundle (A) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Application.AdBundle (A) virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Attempts to modify proxy settings

Related domains:

z.whorecord.xyz
a.tomx.xyz
post.securestudies.com

How to determine Application.AdBundle (A)?


File Info:

crc32: CD1C91F5
md5: 5bbc12a5deefab672603c94dc1858166
name: gameswift.exe
sha1: d35dc3044cef305b0ab03bb41374479c666701b7
sha256: 002dc4edf45cdda1f972abda5ab9efde0324f615c41540775bd79c8f36f51b4d
sha512: cd6a09d47b2384b7099c5730902407f4d8d6b5ed48242d5ff8f369be775062b20ffe8c2ec94c1c0098ba943a27a75a68425ad8887d9fea05ca6376077fff2828
ssdeep: 196608:lpotE07qS/hOvgZXeUvvaimBdKZ6p5gzjeWA2FG:9K1/hOUxaimBdG8g+J
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright xa9 2001-2020 PGWARE LLC
FileVersion: 1.0.0.1
CompanyName: PGWARE LLC
Comments: This installation was built with Inno Setup.
ProductName: GameSwift
ProductVersion: 1.0.0.1
FileDescription: GameSwift Setup
OriginalFileName:
Translation: 0x0000 0x04b0

Application.AdBundle (A) also known as:

CylanceUnsafe
K7GWAdware ( 005616f61 )
K7AntiVirusAdware ( 005616f61 )
CyrenW32/Application.DREN-6844
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
GDataWin32.Application.Agent.HXVR40
Kasperskynot-a-virus:Downloader.Win32.Agent.mgav
AlibabaDownloader:Win32/BundleLoader.1e4b41d5
AegisLabRiskware.Win32.Agent.1!c
SophosGeneric PUA ND (PUA)
McAfee-GW-EditionBehavesLike.Win32.BadFile.vc
EmsisoftApplication.AdBundle (A)
MicrosoftProgram:Win32/Wacapew.C!ml
ZoneAlarmnot-a-virus:Downloader.Win32.Agent.mgav
MalwarebytesPUP.Optional.BundleInstaller
ESET-NOD32a variant of Win32/BundleLoader.J potentially unwanted
IkarusPUA.BundleLoader
FortinetRiskware/BundleLoader
AVGWin32:Malware-gen
Qihoo-360Win32/Virus.Downloader.132

How to remove Application.AdBundle (A)?

Application.AdBundle (A) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment