Should I remove "Generic PUA BH (PUA)"?

The Generic PUA BH (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic PUA BH (PUA) virus can do?

Presents an Authenticode digital signature
Starts servers listening on 127.0.0.1:0
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX

Related domains:

z.whorecord.xyz

a.carambis.com

a.tomx.xyz

How to determine Generic PUA BH (PUA)?


File Info:
crc32: 29DE9363
md5: 36c09a2e20e786848229e01d2721d8e8
name: InstallerCC__a350.exe
sha1: 17e723309b414b1d8b7aa65b899013bdcfbe8264
sha256: 86c4ad66d4b5556a0c0b64b1edada5aed97d91f2b436bb886a30c1bcae91fa66
sha512: f814b6aa4454e8aff052ac75d3918337b29cfcae39250eb681029d04eb5fac57521fa2adcf7c214f6a39e2da2e61facb8cb641b33d74a5e2c34a0ab114cb71e5
ssdeep: 24576:+JQgpkWUTjQwihEHE0wH82d/ehQFQux+JbagFfx9T8z92ZTkM8FmLulCDZ:+6mDU1s8wH86mhQFQQyugFfnT84pkM8W
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: xa9 2020 ROSTPAY LTD. All rights reserved.
InternalName: CarambisCleaner
FileVersion: 2.0.2.0
ProductName: CarambisCleaner
ProductVersion: 2.0.2.0
FileDescription: Carambis Cleaner Installer
Translation: 0x0409 0x04b0

Generic PUA BH (PUA) also known as:

Cylance	Unsafe
K7AntiVirus	Adware ( 0055d22b1 )
K7GW	Adware ( 0055d22b1 )
Sophos	Generic PUA BH (PUA)
DrWeb	Program.Unwanted.4320
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Webroot	Pua.Rostpay
Antiy-AVL	GrayWare/Win32.Rostpay
Microsoft	PUA:Win32/Rostpay
VBA32	SigRiskware.ROSTPAYLTD
ESET-NOD32	a variant of Win32/Rostpay.E potentially unwanted
Fortinet	Riskware/Generic_PUA_BH

How to remove Generic PUA BH (PUA)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “Generic PUA BH (PUA)”?