About “Backdoor:Win32/Meciv.A” infection

The Backdoor:Win32/Meciv.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Meciv.A virus can do?

HTTPS urls from behavior.
Authenticode signature is invalid
Attempts to modify proxy settings
Anomalous binary characteristics

How to determine Backdoor:Win32/Meciv.A?


File Info:
name: 140C69EA9A963100E754.mlw
path: /opt/CAPEv2/storage/binaries/c2135ccc8a46d4bda7b6052df92035a134b83b8f78b8ba078621d537db021bc7
crc32: 19CF9DFD
md5: 140c69ea9a963100e75497b33820f1da
sha1: 1124f1815fd9ac486af884910f1057f74c77de1e
sha256: c2135ccc8a46d4bda7b6052df92035a134b83b8f78b8ba078621d537db021bc7
sha512: 6996528d9e4b649162fafb351e111720786b1b0eb6676a0a49af73c86ed3ade9f8363935860dad509177f8fa1ade1d668ced59f05a7b408b94b2fbc4aa7625f4
ssdeep: 1536:u6CQzj4GgIrtxTilfnblH4uBqkqK+L95uo:gQPDuxlDX+L95l
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T199638D007641D237C9465038B12AE7B25B7EB93019F4C947BB931BAE8F712D1F12A39B
sha3_384: 20bc67d57c4f04fc80fbf1f92c7671d2bf34dc6adf917e9bf16333db232dda670682b8f84319b408599224bfc2f59cf8
ep_bytes: 8bff558bec837d0c017505e8f3390000
timestamp: 2011-04-26 09:08:59

Version Info:
0: [No Data]

Backdoor:Win32/Meciv.A also known as:

Lionic	Trojan.Win32.Agent.lw50
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Application.Keylogger.WebWatcher.82
ClamAV	Win.Trojan.Enfal-100
FireEye	Generic.mg.140c69ea9a963100
Skyhigh	BehavesLike.Win32.Dropper.kh
McAfee	GenericRXFD-RF!140C69EA9A96
Malwarebytes	Malware.AI.2032304419
Zillya	Backdoor.Agent.Win32.31692
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004e68fc1 )
Alibaba	Backdoor:Win32/Meciv.71246300
K7GW	Trojan ( 004e68fc1 )
CrowdStrike	win/malicious_confidence_90% (D)
BitDefenderTheta	Gen:NN.ZedlaF.36744.eu4@aKQtR9pi
VirIT	Backdoor.Win32.Agent.AKYX
Symantec	Backdoor.Samkams!gen
ESET-NOD32	a variant of Win32/Pucedoor.A
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Application.Keylogger.WebWatcher.82
NANO-Antivirus	Trojan.Win32.Agent.cxzie
Avast	Win32:BackdoorX-gen [Trj]
TACHYON	Backdoor/W32.Meciv.70144.B
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	BackDoor.Siggen.29494
VIPRE	Gen:Variant.Application.Keylogger.WebWatcher.82
TrendMicro	BKDR_MECIV.SME
Emsisoft	Gen:Variant.Application.Keylogger.WebWatcher.82 (B)
Ikarus	Trojan-Dropper.Agent
GData	Gen:Variant.Application.Keylogger.WebWatcher.82
Jiangmin	Backdoor/Agent.cpvg
Webroot	W32.Backdoor.Gen
Varist	W32/Meciv.B.gen!Eldorado
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan[APT]/Win32.Sindigoo
Xcitium	TrojWare.Win32.Trojan.XPack.~gen1@1rwlif
Arcabit	Trojan.Application.Keylogger.WebWatcher.82
ViRobot	Backdoor.Win32.A.Agent.70144.C
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Backdoor:Win32/Meciv.A
Google	Detected
AhnLab-V3	Backdoor/Win32.Agent.R5941
ALYac	Gen:Variant.Application.Keylogger.WebWatcher.82
MAX	malware (ai score=100)
VBA32	Backdoor.Agent
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	BKDR_MECIV.SME
Rising	Backdoor.Meciv!8.1C10 (TFE:5:CfW4VOesWpI)
Yandex	Backdoor.Agent!y4trumgKSek
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.2257677.susgen
Fortinet	W32/Agent.BG!tr
AVG	Win32:BackdoorX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Backdoor:Win32/Meciv.A?

Backdoor:Win32/Meciv.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X