Should I remove "Exploit.Win32.BypassUAC.orz"?

The Exploit.Win32.BypassUAC.orz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Exploit.Win32.BypassUAC.orz virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Reads data out of its own binary image
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

Related domains:

wpad.local-net

dl.enhknqql.club

tj.enhknqql.club

How to determine Exploit.Win32.BypassUAC.orz?


File Info:
name: 7D56851D29461AF741EE.mlw
path: /opt/CAPEv2/storage/binaries/58c7257667b3501c2fab094b2553d0c4e4c47614dde03b2affec4e978b19fee2
crc32: DEAE62B0
md5: 7d56851d29461af741ee9e5bf62f53c0
sha1: e3a00bc32a837f9235a1d2178a6bc0c2b0705ae3
sha256: 58c7257667b3501c2fab094b2553d0c4e4c47614dde03b2affec4e978b19fee2
sha512: 1ae31eb10f67522cc80f7d908b2ac0d7a0ed63c2eefb6c66bf0ffb4acc144b07f9d5b1eb4746108b9e44b78cd9b5e7ea400bdd2b0237cde9d4ed98562b646bc7
ssdeep: 6144:7rojx83rBpKkOfeQ25t3LACLbb061ajUdNXvpbovxx+a/Z6py:Ajx8NpKkL5WCLbb061DvJovyS6y
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DE641222FBC19076F060CB304E2292480A7B7E271D3C255D76DC6C9E5F375D2A61A7AB
sha3_384: de2ba9783b3b8d06f91cce92b179926cf9af87e8267635b8c8fe805ab28ccbc94106695e7df5a04c77560c79d327f3bc
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: 10781                                                       
FileDescription: 10781 Setup                                                 
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: 10781                                                       
ProductVersion: 10781               
Translation: 0x0000 0x04b0

Exploit.Win32.BypassUAC.orz also known as:

Lionic	Hacktool.Win32.BypassUAC.3!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37343994
FireEye	Trojan.GenericKD.37343994
ALYac	Trojan.GenericKD.37343994
Cylance	Unsafe
Zillya	Exploit.BypassUAC.Win32.2086
K7AntiVirus	Trojan-Downloader ( 0001e3c01 )
Alibaba	TrojanDownloader:Win32/BypassUAC.64eda1ad
K7GW	Trojan-Downloader ( 0001e3c01 )
CrowdStrike	win/malicious_confidence_80% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.EBX
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	Exploit.Win32.BypassUAC.orz
BitDefender	Trojan.GenericKD.37343994
NANO-Antivirus	Exploit.Win32.BypassUAC.fimlql
Avast	Win32:Malware-gen
Tencent	Win32.Exploit.Bypassuac.Ajlu
Ad-Aware	Trojan.GenericKD.37343994
Comodo	Malware@#22d6jqcji752z
DrWeb	Trojan.DownLoader27.5626
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PH621
Sophos	Mal/Generic-S
GData	Trojan.GenericKD.37343994
Jiangmin	Trojan.Generic.dkuth
MAX	malware (ai score=99)
Arcabit	Trojan.Generic.D239D2FA
Microsoft	Trojan:Win32/Skeeyah.A!rfn
AhnLab-V3	PUP/Win32.DealPlay.R365175
McAfee	RDN/Generic Downloader.x
Malwarebytes	Malware.AI.3869358055
TrendMicro-HouseCall	TROJ_GEN.R002C0PH621
Ikarus	Trojan.Downloader.Inno.Agent
Fortinet	W32/Agent.EBX!tr.dldr
AVG	Win32:Malware-gen

How to remove Exploit.Win32.BypassUAC.orz?

Exploit.Win32.BypassUAC.orz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “Exploit.Win32.BypassUAC.orz”?