Malware

Downloader.Win32.StartPage.o removal guide

Malware Removal

The Downloader.Win32.StartPage.o is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Downloader.Win32.StartPage.o virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Presents an Authenticode digital signature
  • Anomalous file deletion behavior detected (10+)
  • Dynamic (imported) function loading detected
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)

How to determine Downloader.Win32.StartPage.o?



File Info:

name: 30251A05B5F5EA1BCD23.mlw
path: /opt/CAPEv2/storage/binaries/a8407c988bb4077d3703edb9f1a183071245e840a056a967297d570dc6508ff3
crc32: 330B1974
md5: 30251a05b5f5ea1bcd236150f6eae60d
sha1: 1b2bafa97ef10dbc3d11cadceefe85c21315006e
sha256: a8407c988bb4077d3703edb9f1a183071245e840a056a967297d570dc6508ff3
sha512: 2a064a585d3df261abb3ff6b163e81c5a8568eb6a46ddea37098a53ec1955341a557af2afcd907b7be4fb37e9b7a0d62cba2cbb8d1ffb32aa69fa61e02ba77be
ssdeep: 12288:qX1wH/ED7QhS9t8XL5hbhRbAzhLL6V0XYH67crURbq66l4/aouXe4+dLXgajYrDz:qXU09t8XLX8hf6VAYCG6WouT8waEr42
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T121358F02F781C062FE9B59334A5AF231977C791E4037A52F13981E79B9B2271163EE63
sha3_384: 45597778a5c15d3c4e4612e96e6734c5f7567af64d788def98a00635602e7aa3de199a02cd1be47440341a4d5e5f2c3d
ep_bytes: e86e050000e97afeffff558bec56ff75
timestamp: 2021-05-14 01:11:59


Version Info:

FileVersion: 2.0.3.1312
Comments: CopyLick Corporation
FileDescription: CopyLick
ProductVersion: 2.03.1312
LegalCopyright: (C) CopyLick. All rights reserved.
CompanyName: CopyLick? System
ProductName: CopyLick
Translation: 0x0804 0x04b0

Downloader.Win32.StartPage.o also known as:

LionicRiskware.Win32.StartPage.1!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
McAfeeArtemis!30251A05B5F5
CylanceUnsafe
ZillyaTrojan.Obfuscated.Win32.95080
K7AntiVirusTrojan ( 00579ffd1 )
AlibabaDownloader:Win32/StartPage.8ea0d105
K7GWTrojan ( 00579ffd1 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/AutoIt.UP.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/GenCBL.AJQ
Paloaltogeneric.ml
ClamAVWin.Malware.Nymeria-9879923-0
Kasperskynot-a-virus:Downloader.Win32.StartPage.o
BitDefenderGen:Variant.Zusy.377320
MicroWorld-eScanGen:Variant.Zusy.377320
AvastWin32:Trojan-gen
TencentMalware.Win32.Gencirc.11cbdef9
Ad-AwareGen:Variant.Zusy.377320
SophosMal/Generic-S
ComodoMalware@#3h419dt1ir7jx
F-SecureHeuristic.HEUR/AGEN.1245856
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.F0CBC0UH521
McAfee-GW-EditionArtemis!Trojan
FireEyeGen:Variant.Zusy.377320
EmsisoftGen:Variant.Zusy.377320 (B)
IkarusTrojan.Win32.Generic
GDataGen:Variant.Zusy.377320
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1245856
Antiy-AVLTrojan/Generic.ASMalwS.30F6B20
ArcabitTrojan.Zusy.D5C1E8
ZoneAlarmnot-a-virus:Downloader.Win32.StartPage.o
MicrosoftTrojan:Win32/Sabsik.DA!MTB
AhnLab-V3Malware/Win.Generic.R416907
ALYacGen:Variant.Zusy.377320
MAXmalware (ai score=88)
VBA32Trojan.Script
MalwarebytesTrojan.Agent
TrendMicro-HouseCallTROJ_GEN.F0CBC0UH521
RisingAdware.Agent!1.D343 (CLASSIC)
MaxSecureTrojan.Malware.117045383.susgen
FortinetW32/GenCBL.AJQ!tr
AVGWin32:Trojan-gen
PandaTrj/Genetic.gen

How to remove Downloader.Win32.StartPage.o?

Downloader.Win32.StartPage.o removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment