Backdoor:Win32/Berbew!pz removal instruction

The Backdoor:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Berbew!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Backdoor:Win32/Berbew!pz?


File Info:
name: B3B7EE3A29043B137BAD.mlw
path: /opt/CAPEv2/storage/binaries/aa29d766149dfa108a6587be0942bf8eabd47968a4f56cb0b9429cb444034039
crc32: DBBC30A8
md5: b3b7ee3a29043b137badc548537f5fe7
sha1: d92c37ca7220ca6c9c4f95277da9b19e49814b49
sha256: aa29d766149dfa108a6587be0942bf8eabd47968a4f56cb0b9429cb444034039
sha512: d0c904ee57ad36c9e2932b05fd357a8c26b89431665cd537347b800b649d32360cf349252edbbf0744894b91b7f31d79d09969a9d46c98ceba28e89352d04e3b
ssdeep: 768:eGmRRPb2XjUr00qMOopBkjUzOZxfu7frO2WQOuvjZcd5JcNoCLG4JSxK2wH3CxSc:zaRPbgCasBfajfCy2FO2/G4AfpSj+d+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15C142A2B00F29BB3EC4DC7BB24F33567C282CFB9551E560A9624C15A4B27CDD99E0623
sha3_384: e934ad1b55ccd63906200cadf3b2bdb2640105ba7b1c51a98f265336077b9e32b489c7273f3967d49d8148587605a69a
ep_bytes: 00000000000000000000000000000000
timestamp: 2019-11-21 22:06:51

Version Info:
0: [No Data]

Backdoor:Win32/Berbew!pz also known as:

Bkav	W32.AIDetectMalware
CyrenCloud	W32/Nymaim.FY.gen!Eldorado
Lionic	Trojan.Win32.Convagent.4!c
FireEye	Generic.mg.b3b7ee3a29043b13
Skyhigh	BehavesLike.Win32.Generic.dz
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:Win32/Cerber.cea6811f
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Generickdz-10013340-0
Kaspersky	HEUR:Trojan.Win32.Convagent.gen
NANO-Antivirus	Trojan.Win32.Convagent.kfebob
Avast	Win32:TrojanX-gen [Trj]
Baidu	Win32.Trojan-Spy.Quart.a
DrWeb	BackDoor.IRC.Tdongs
TrendMicro	TROJ_GEN.R03BC0PKL23
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Varist	W32/Nymaim.FY.gen!Eldorado
Kingsoft	malware.kb.a.1000
Microsoft	Backdoor:Win32/Berbew!pz
ZoneAlarm	HEUR:Trojan.Win32.Convagent.gen
GData	Win32.Trojan.PSE.1YSHFBU
Google	Detected
Acronis	suspicious
McAfee	GenericRXVP-XD!B3B7EE3A2904
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R03BC0PKL23
Rising	Backdoor.Berbew!1.AE0A (CLASSIC)
Ikarus	Trojan.Win32.Cerber
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/CoinMiner.3E08!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.a7220c
DeepInstinct	MALICIOUS

How to remove Backdoor:Win32/Berbew!pz?

Backdoor:Win32/Berbew!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X