Backdoor:Win32/Poison.AC removal guide

The Backdoor:Win32/Poison.AC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Poison.AC virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine Backdoor:Win32/Poison.AC?

File Info:
name: DAAACB4EB3806A1247DA.mlw
path: /opt/CAPEv2/storage/binaries/ab88d6932aed5208697e182b0ced7c2267d88ab41c3f7d7353a896f57ae972c4
crc32: 401BE3AA
md5: daaacb4eb3806a1247dad09cabdff04f
sha1: ab9b3c78a78b1f78c66442187f85af667f95738e
sha256: ab88d6932aed5208697e182b0ced7c2267d88ab41c3f7d7353a896f57ae972c4
sha512: 2ddcbc6817cfd96f3bba2174a1927fc0bc6bfce073716080bbe554c73573339b5442f2ac00af2ada025f428bfc68db2108d6b3e35248c2ef5b0da850bfc9557e
ssdeep: 12288:XJRSUWK87Y4Y1uIx9LWcVlN/RtBY2Gs1H:XJiVsRuIxZndJ02G0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198840202421CFFF1E6A11DF0C4A73562A3137C6A1A272686DF1B7875AD32AC34946F5B
sha3_384: a938575e70a18cc0edca3db87cee7e6830e7a545845d22c95aa4666e9b5adbc603be5d0a21c9419282b675256e98401a
ep_bytes: 6050565251f7d8f6d36814124000e858
timestamp: 2009-01-04 20:53:21

Version Info:
Translation: 0x0409 0x04b0
Comments: Comments
CompanyName: Company Name
FileDescription: File Description
LegalCopyright: Legal Copyright
LegalTrademarks: Legal Trademarks
ProductName: Product Name
FileVersion: 1.00
ProductVersion: 1.00
InternalName: Project1
OriginalFilename: Project1.exe

Backdoor:Win32/Poison.AC also known as:

How to remove Backdoor:Win32/Poison.AC?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.