How to remove “Cerbu.149814”?

The Cerbu.149814 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.149814 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• A file with an unusual extension was attempted to be loaded as a DLL.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Transacted Hollowing
• Likely virus infection of existing system binary
• Deletes executed files from disk

How to determine Cerbu.149814?

File Info:
name: 0F8188AB6F8FD4AD35FF.mlw
path: /opt/CAPEv2/storage/binaries/373a8611e8005eba9b8eb57cbf6897ba2520df4dac381331d19e783f0f44f3b6
crc32: 8B64A7A2
md5: 0f8188ab6f8fd4ad35ffb2ba1b472947
sha1: cfca2d889c26a0946e73d4f27e28e5ae1d24a5ec
sha256: 373a8611e8005eba9b8eb57cbf6897ba2520df4dac381331d19e783f0f44f3b6
sha512: 7b4ca93f1cd2732635deba6dfb815b161392d550cbfb59c90486b1ff2e58ef0c235c47f9d1b2b6ae9364498dc2e73796200387eff74bf41355acfce5baba8a23
ssdeep: 98304:OioOuaGDki5eNTu03IdIyv/rYWKmYGD+oR2u72j3tZN9MHPe1ROb12LLu3p+33nj:7ojGi5HaIakFtH2uSj9ZzMWHOb12b3j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1487633C0F0C5C0D5C52D67B04EA6956D1A32BCECEA71922D3F71BA9F2E3D3560829C5A
sha3_384: ac3d4c5d0064cd604b32dfcc1c96d2312c4ba52f36f31baa8b572412743824118f1eab8e92b3b950bda1582e04e4ec3e
ep_bytes: 558bec83c4d453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName: BitABF                                                      
FileDescription: UndeleteMyFiles Pro Setup                                   
FileVersion:                     
InternalName: 
OriginalFilename: 
ProductName: 
ProductVersion: 
Translation: 0x0409 0x04e4

Cerbu.149814 also known as:

How to remove Cerbu.149814?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.