Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Spy
Threat report

BScope.TrojanSpy.GrammarSpy removal

Published Apr 18, 2024 Spy category 2 min read
Report context

What to verify before removal

BScope.TrojanSpy.GrammarSpy removal deserves a credential-safety review because this spy label can overlap with remote access, browser data theft, or persistence after reboot. Cleanup should include scanning the file, removing the persistence point, and rotating exposed passwords from a clean device.

Start by comparing the local file name with B889ECA3046B9A2DD352.mlw, then review the behavior notes for credential theft, browser data access, remote-control activity, and persistence after reboot. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
B889ECA3046B9A2DD352.mlw
  • Compare the suspicious file name with B889ECA3046B9A2DD352.mlw.
  • Confirm the detection name matches BScope.TrojanSpy.GrammarSpy removal before removing related files.
  • Review the report for credential theft, browser data access, remote-control activity, and persistence after reboot so the cleanup is based on observed behavior, not only the label.
  • After cleanup, rotate passwords from a clean device and review browser sessions or saved credentials.

The BScope.TrojanSpy.GrammarSpy is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What BScope.TrojanSpy.GrammarSpy virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine BScope.TrojanSpy.GrammarSpy?



File Info:

name: B889ECA3046B9A2DD352.mlw
path: /opt/CAPEv2/storage/binaries/ef7fc3a23ddb20eb04ea21a48b8b0e6a942f8bcb25070f308e1b338d2baf4337
crc32: 61B3E88E
md5: b889eca3046b9a2dd3523ca391dd8c36
sha1: bc288cc01a992034c6c3ef87b9969840da9cc904
sha256: ef7fc3a23ddb20eb04ea21a48b8b0e6a942f8bcb25070f308e1b338d2baf4337
sha512: e0d6d4f610d6ee85139c6f333c03023f237458dc392e7b281f780dba7f8c8b98470bfd0d3695f7c29e3a92912ef8c45a3beadea29c51310a3d788e9cf1fe3104
ssdeep: 24576:u1w890D7Z7Q8xtDmO8wo9h31ZWIMhSmsA8LRt2FV/2aD:8390D7Z7Q8xX8NR1IsAY2WaD
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1CC553901B7905129FDF705FA9AFE746C542CBAF00B28A0C751C82AEE9A65BF57C31613
sha3_384: 0134d0d2d590b6e6acc36bc72b6510c78f642ee1d5631f66ce19bd0df70ed7e90ccfd3794c9b12057c18a743d38c8f38
ep_bytes: e944ab0500e96f0d0700e92a780100e9
timestamp: 2019-11-15 19:07:29


Version Info:

0: [No Data]

BScope.TrojanSpy.GrammarSpy also known as:

Bkav W32.AIDetectMalware
Skyhigh BehavesLike.Win32.BadFile.tm
McAfee GenericRXAA-FA!B889ECA3046B
Sangfor Trojan.Win32.Agent.Vjqk
Symantec Trojan.Gen.MBT
Avast Win32:Malware-gen
Kaspersky VHO:Trojan.Win32.Convagent.gen
Sophos Mal/Generic-S
Google Detected
Antiy-AVL Trojan/Win32.Wacatac
Microsoft Trojan:Win32/Zpevdo.A
ZoneAlarm VHO:Trojan.Win32.Convagent.gen
Varist W32/ABTrojan.JUCH-0027
BitDefenderTheta Gen:NN.ZexaF.36802.tPW@ameherli
VBA32 BScope.TrojanSpy.GrammarSpy
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H07DF24
Rising Trojan.Generic@AI.96 (RDML:+xOf1kUBWTBSv+vSegQGBw)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenericRXJG.HW!tr
AVG Win32:Malware-gen
DeepInstinct MALICIOUS

How to remove BScope.TrojanSpy.GrammarSpy?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.