Generic PUA NH removal tips

The Generic PUA NH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Generic PUA NH virus can do?

Authenticode signature is invalid
Anomalous binary characteristics

How to determine Generic PUA NH?


File Info:
name: C66574A5A3EECC7BB56A.mlw
path: /opt/CAPEv2/storage/binaries/22ee804ffea818cc59a53d4f85f980a93faff5a53d4711b31cb5cef56b172081
crc32: C06CB02C
md5: c66574a5a3eecc7bb56a3814dc06b63e
sha1: d77188b384b385d132c9e051711fcfa2cce28b82
sha256: 22ee804ffea818cc59a53d4f85f980a93faff5a53d4711b31cb5cef56b172081
sha512: a1bf1265dfd63d099f162d0fd2f1c58d5fbf16478a8a7244a2ab5ba7aaf3f0d94cdd448b1b54df961500012cd9415487ebd44da157e616dff7b4af4ac6dec273
ssdeep: 49152:qbmjFHJ/TH0TheVHgOGf5lYvoGxUSJpX:fjJJ7dHgOUsRX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T122C56B10B3E0C132E0B66671897AA7759A76BC514B3187CB62487BEE5F367C09E34327
sha3_384: 6fad892f9983b5dfd9b38c05edf68ada4d390713536f09b981a8bcd032e2914841d295634e09cf266f3aef776e51cae7
ep_bytes: 6a706820144000e8f701000033db538b
timestamp: 2004-08-04 06:02:34

Version Info:
CompanyName: Microsoft Corporation
FileDescription: CTF Loader
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: CTFMON
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: CTFMON.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.2180
OleSelfRegister: 
Translation: 0x0409 0x04b0

Generic PUA NH also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!C66574A5A3EE
Cyren	W32/Olext.C.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:UDS:RiskTool.Win64.Injector.a
Avast	Win32:Malware-gen
Sophos	Generic PUA NH
McAfee-GW-Edition	BehavesLike.Win32.Virut.vm
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1137281
Microsoft	Trojan:Win32/Wacatac.B!ml
Malwarebytes	Malware.AI.2478817681
Ikarus	Trojan.Dropper
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/SPNR.15EG12!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Generic PUA NH?

Generic PUA NH removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X