Backdoor:Win32/Berbew!pz removal instruction

The Backdoor:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Berbew!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Backdoor:Win32/Berbew!pz?


File Info:
name: 18FE3373334C4227E010.mlw
path: /opt/CAPEv2/storage/binaries/86e0c3e0753832d12c01574fb6e58ad5d9f2895c9a3d4d9615aaf435b23af83b
crc32: 869CE0E4
md5: 18fe3373334c4227e010fbd46f42d4e2
sha1: 2a0a08850f4973972e91a572c30ca06d361b18de
sha256: 86e0c3e0753832d12c01574fb6e58ad5d9f2895c9a3d4d9615aaf435b23af83b
sha512: 400b1e3c5fd03963a091bacbb8b9d1cbb2e66056b151513e2c95e1201a1a86455ad9cd9f8eae7d9fb486d5a990db44c39c84d097d89f6bc6139ba5e4e1643279
ssdeep: 768:/yDm/AeTz+Z/CRTlumDpyNT/ISH1vAeUTgqEIHEgT402x/o3bU3QqLk+Pk0:jeZqTlucpy99oeUTgq9fT4N/o3I5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F114AF7466D7C1BCD4075871EF3E9746AC903E1D2B24DBEAC19C324C26291E594FAD38
sha3_384: 947cc1e98869d0d138dcb38372ee306e962ccf00913e7047596f8dc69cf04b35279b812dd02b09391cee8c0917919018
ep_bytes: 00000000000000000000000000000000
timestamp: 2020-07-11 03:39:59

Version Info:
0: [No Data]

Backdoor:Win32/Berbew!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Padodor.h!c
FireEye	Generic.mg.18fe3373334c4227
Skyhigh	BehavesLike.Win32.Generic.dz
Malwarebytes	Backdoor.Padodor
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005993611 )
K7GW	Trojan ( 005993611 )
Cybereason	malicious.50f497
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Padodor.NAM
APEX	Malicious
Kaspersky	VHO:Trojan-Proxy.Win32.Convagent.gen
ViRobot	Trojan.Win.Z.Qukart.208896.UW
Rising	Trojan.Generic@AI.100 (RDMK:HdwpobosRodJ4xF+MZEaHg)
TrendMicro	TROJ_GEN.R03BC0DK523
Trapmine	malicious.high.ml.score
Sophos	Mal/Padodor-C
SentinelOne	Static AI – Malicious PE
Google	Detected
Varist	W32/Razy.EB.gen!Eldorado
Kingsoft	malware.kb.a.1000
Microsoft	Backdoor:Win32/Berbew!pz
Xcitium	Worm.Win32.Qukart.K@565w5t
ZoneAlarm	VHO:Trojan-Proxy.Win32.Convagent.gen
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C1586827
VBA32	TrojanProxy.Qukart
DeepInstinct	MALICIOUS
Cylance	unsafe
Zoner	Probably Heur.ExeHeaderL
TrendMicro-HouseCall	TROJ_GEN.R03BC0DK523
Ikarus	Trojan.Crypt
MaxSecure	Virus.Mabezat.Dam
Fortinet	W32/Qukart.8979!tr
AVG	Win32:BackdoorX-gen [Trj]
Avast	Win32:BackdoorX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Backdoor:Win32/Berbew!pz?

Backdoor:Win32/Berbew!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X