Dropped:Application.Starter.C removal tips

The Dropped:Application.Starter.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Dropped:Application.Starter.C virus can do?

Sample contains Overlay data
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Attempts to modify proxy settings
Anomalous binary characteristics

How to determine Dropped:Application.Starter.C?


File Info:
name: C05BBBC9CEE016C63D9C.mlw
path: /opt/CAPEv2/storage/binaries/70cafb01e090f63a1cb77ba0e2876a529bdf5642893d9efd26e2238e3801e39d
crc32: 1E08AC44
md5: c05bbbc9cee016c63d9ccb34c0418ced
sha1: d33396fed7d147960eb0956bb69f23f481e589e4
sha256: 70cafb01e090f63a1cb77ba0e2876a529bdf5642893d9efd26e2238e3801e39d
sha512: b97f21207d196e9522c5628a00194d2d72a10321dbae02a329c89ef9f2c5bc49c5405939fa4c8f7e4d65a7f91426e04da555420b47cd90211160c457b5545f92
ssdeep: 192:XHmupjfs4B9M562YwimWm8fe4WDaJUW781gW:XuGsimWDWDauW781gW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18062EA02D7E8AD25F4B301701892671796287470C8669F4F3E8C114A5F392D7FBB6672
sha3_384: 01aaea76474b4294f8f5356bf5364c3cfd3bae22f94d6f89cdda396dbe9e21045d6b58c0dd3f55ab3d460e346ed95f9a
ep_bytes: 558bec6aff683020400068702d400064
timestamp: 2009-02-13 11:21:06

Version Info:
CompanyName: Microsoft Corporation
FileDescription: CTF Loader
FileVersion: 5.1.2600.5512 (xpsp.080413-2105)
InternalName: CTFMON
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: CTFMON.EXE
ProductName: ® Microsoft Windows  Operating System
ProductVersion: 5.1.2600.5512
OleSelfRegister: 
Translation: 0x0809 0x04b0

Dropped:Application.Starter.C also known as:

AVG	Win32:Downloader-DJL [Trj]
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Application.Starter.C
FireEye	Generic.mg.c05bbbc9cee016c6
Skyhigh	BehavesLike.Win32.Generic.lt
McAfee	GenDownloader.db
Cylance	unsafe
Zillya	Exploit.IMG.Win32.60
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005376ae1 )
Alibaba	TrojanDownloader:Win32/Gofot.4e16a628
K7GW	Trojan ( 005376ae1 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	AI:Packer.8FC591341C
VirIT	Trojan.Win32.Generic.BNJQ
Symantec	Downloader
ESET-NOD32	a variant of Win32/TrojanDownloader.Small.OGQ
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Trojan.Rootkit-61
Kaspersky	Trojan.Win32.Gofot.daa
BitDefender	Dropped:Application.Starter.C
NANO-Antivirus	Exploit.Win32.IMGWMF.bekfuj
Avast	Win32:Downloader-DJL [Trj]
Tencent	Malware.Win32.Gencirc.10b30f32
TACHYON	Trojan-Exploit/W32.IMG-WMF.15360.C
Emsisoft	Dropped:Application.Starter.C (B)
F-Secure	Trojan.TR/Hijacker.Gen
DrWeb	Trojan.KillProc.27800
VIPRE	Dropped:Application.Starter.C
TrendMicro	TROJ_EXPLOIT_0000005.TOMA
Trapmine	malicious.moderate.ml.score
Sophos	Mal/SwiftG-D
SentinelOne	Static AI – Suspicious PE
Jiangmin	Exploit.IMG-WMF.cy
Varist	W32/OnlineGames.AJ.gen!Eldorado
Avira	TR/Hijacker.Gen
Antiy-AVL	Trojan[Exploit]/Win32.IMG-WMF
Kingsoft	Win32.Trojan.Gofot.daa
Microsoft	TrojanDownloader:Win32/Small.gen!AO
Xcitium	TrojWare.Win32.TrojanDownloader.Generic.db0@1d9fjw
Arcabit	Application.Starter.C
ZoneAlarm	Trojan.Win32.Gofot.daa
GData	Dropped:Application.Starter.C
Google	Detected
AhnLab-V3	Trojan/Win32.Exploit.R6529
Acronis	suspicious
VBA32	BScope.TrojanDownloader.Agent
ALYac	Dropped:Application.Starter.C
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware.AI.DDS
Panda	Exploit/Metafile
TrendMicro-HouseCall	TROJ_EXPLOIT_0000005.TOMA
Rising	Trojan.Clicker.Win32.Undef.go (CLASSIC)
Yandex	Trojan.Runner.Gen.2
Ikarus	Exploit.Win32.IMG-WMF
MaxSecure	Trojan.Malware.713147.susgen
Fortinet	W32/Runner.BV!tr
Cybereason	malicious.9cee01
DeepInstinct	MALICIOUS
alibabacloud	Trojan[downloader]:Win/Gofot.daa

How to remove Dropped:Application.Starter.C?

Dropped:Application.Starter.C removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X