How to remove “Fugrafa.26950”?

The Fugrafa.26950 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Fugrafa.26950 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Attempts to stop active services
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Created a service that was not started
• Anomalous binary characteristics

How to determine Fugrafa.26950?

File Info:
name: 924E8B20676B6FB68957.mlw
path: /opt/CAPEv2/storage/binaries/2a41d95d9f7334f798d665d6e9e9a2489b284c875bf52367c2268a95bd27883a
crc32: 1478B6E5
md5: 924e8b20676b6fb6895723c5162c6b63
sha1: 95e74de5022de3afd990ae0a784b3428464792f0
sha256: 2a41d95d9f7334f798d665d6e9e9a2489b284c875bf52367c2268a95bd27883a
sha512: 121382e7d5a7fd839581a607aa955e945aecd620c03144c242eda6ef0836c011a686f4df382643c499b90dcbed6714026f1ccc4049c858d6e6b569dfff9626e5
ssdeep: 6144:NL9nhFzR/O1BWL9nhFzR/O1BWL9nhFzR/O1BWL9nhFzR/O1B0:lphD21BkphD21BkphD21BkphD21B0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E8A4CE3A3E87B670F71895748AB83D3F8561F9335DD9A08CD7B86A023130DA47B9560E
sha3_384: 7de8830b663fcd096eeac14c5dc87ff16b9d444df53f3fa86cb0bd1f86624e6b0e730ba7e2ba7e10bd8d655002e86a77
ep_bytes: 64a1000000005589e56aff681c804000
timestamp: 2004-03-24 08:43:55

Version Info:
0: [No Data]

Fugrafa.26950 also known as:

How to remove Fugrafa.26950?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.