Malware

Downloader.Win32.Yantai.p removal instruction

Malware Removal

The Downloader.Win32.Yantai.p is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Downloader.Win32.Yantai.p virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Attempts to modify proxy settings

Related domains:

z.whorecord.xyz
www.91danji.com
a.tomx.xyz
ip.taobao.com
yxhz.91danji.com

How to determine Downloader.Win32.Yantai.p?


File Info:

crc32: D2F2DDF0
md5: 85e8f18855b615ffd14ac336e796ca3f
name: 91box___0.exe
sha1: 4fca9f4229b0b745be694a92178dc5aa5959ed42
sha256: 1f725a3063ccce023e54ebc8b1a53e9846fd5f062ebba4af5a67fb982c25fff4
sha512: 4435b22cd0feb2c9be263f1b8286fe078e9737966586ca1d64411b96643af2548850045f181bce77237bcf9adf3b7b42cbb2045bd5c6e795d3564338dde0fa14
ssdeep: 98304:AF48HtAjZXFgzJObUWpXA+5N0V2Zbh3rgPxOjuxtaZiOH/+yQD6W+eoptnTlSluI:YBAZFYJO3X55Zrgp6h1+ZD6W+eoLBE6s
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright xa9 2012-2016 91x6e38x620fx76d2x5b50, Inc.
FileVersion: 2016.1024.1612.10
CompanyName: x4e0ax9976x5e02x98cex4e91x7f51x7edcx79d1x6280x6709x9650x516cx53f8
Comments: This installation was built with Inno Setup.
ProductName: 91x6e38x620fx76d2x5b50
ProductVersion: 1.1.5
FileDescription: 91x6e38x620fx76d2x5b50x6700x5168x6700x597dx73a9x6e38x620fx76d2x5b50
Translation: 0x0000 0x04b0

Downloader.Win32.Yantai.p also known as:

BkavW32.HfsAdware.EB59
MicroWorld-eScanTrojan.GenericKD.41373542
McAfeeArtemis!85E8F18855B6
CylanceUnsafe
K7AntiVirusRiskware ( 0040eff71 )
AlibabaDownloader:Win32/Yantai.240eb563
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.229b0b
ArcabitTrojan.Generic.D2774F66
TrendMicroTROJ_GEN.R002C0OFE19
SymantecTrojan.Gen.6
Kasperskynot-a-virus:Downloader.Win32.Yantai.p
BitDefenderTrojan.GenericKD.41373542
NANO-AntivirusTrojan.Win32.Yantai.ftwtjm
RisingAdware.Agent!1.BAC5 (CLASSIC)
Endgamemalicious (high confidence)
EmsisoftTrojan.GenericKD.41373542 (B)
ComodoMalware@#f09y84hna59v
DrWebAdware.WDJiange.45
ZillyaAdware.WDJiangeCRTD.Win32.563
McAfee-GW-EditionArtemis!PUP
FortinetRiskware/Yantai
Trapminemalicious.moderate.ml.score
FireEyeTrojan.GenericKD.41373542
SophosGeneric PUA EP (PUA)
MicrosoftBrowserModifier:Win32/Riccietex
ZoneAlarmnot-a-virus:Downloader.Win32.Yantai.p
VBA32Downloader.Yantai
ALYacTrojan.GenericKD.41373542
Ad-AwareTrojan.GenericKD.41373542
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_GEN.R002C0OFE19
YandexPUA.Downloader!
GDataTrojan.GenericKD.41373542
WebrootW32.Adware.Gen
AVGWin32:Adware-gen [Adw]
AvastWin32:Adware-gen [Adw]

How to remove Downloader.Win32.Yantai.p?

Downloader.Win32.Yantai.p removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment