Backdoor:Win32/Berbew!pz removal tips

The Backdoor:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Berbew!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Backdoor:Win32/Berbew!pz?


File Info:
name: 6A9436A68C24A7744B0E.mlw
path: /opt/CAPEv2/storage/binaries/d32f35632b9d662fe10d9b399d023411b0e99a396129e2111a25772f2790984c
crc32: E2CC46FC
md5: 6a9436a68c24a7744b0e715d520a1838
sha1: 7ea95c73148639120df6908e1d43bca95c6e7323
sha256: d32f35632b9d662fe10d9b399d023411b0e99a396129e2111a25772f2790984c
sha512: 1d34d52775633b41dd979903e2ba92296e7a9d35cadf8e5f777147a8017d6c015994149c7e86617a16c4872447e4caaa3742c2cd492a8fb8fe4679a91a01fcf8
ssdeep: 1536:YY/jaBMgoYgYxi6YQG4FfoDLnKDz7//zuUQkDXgs:DapXYQG4Fyj8//zuZkDws
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B11428F3F8754F92C0C94F33C0A32DB791D885D854EBA01DDA8887D9467BD9A8888BD1
sha3_384: 080a4ad77571ef4901cb65536efec6cb8ee3710d2c58f8e7ea7ec67fa2bb81c246423a65f3299d9109cd7281141178b4
ep_bytes: 00000000000000000000000000000000
timestamp: 2019-11-21 22:06:51

Version Info:
0: [No Data]

Backdoor:Win32/Berbew!pz also known as:

Bkav	W32.AIDetectMalware
Skyhigh	BehavesLike.Win32.Generic.dz
McAfee	GenericRXVP-XD!6A9436A68C24
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.314863
Baidu	Win32.Trojan-Spy.Quart.a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Qukart-6838239-0
Kaspersky	HEUR:Trojan-Proxy.Win32.Convagent.gen
Avast	Win32:TrojanX-gen [Trj]
DrWeb	BackDoor.IRC.Tdongs
TrendMicro	TROJ_GEN.R03BC0DAK24
Sophos	ML/PE-A
Ikarus	Trojan.Win32.Cerber
GData	Win32.Trojan.Agent.4LV1Y1
Varist	W32/Nymaim.FY.gen!Eldorado
Kingsoft	malware.kb.a.1000
ZoneAlarm	HEUR:Trojan-Proxy.Win32.Convagent.gen
Microsoft	Backdoor:Win32/Berbew!pz
Google	Detected
Acronis	suspicious
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R03BC0DAK24
Rising	Backdoor.Berbew!1.AE0A (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/CoinMiner.3E08!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Backdoor:Win32/Berbew!pz?

Backdoor:Win32/Berbew!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X