Categories: Malware

Should I remove “Generic.Servstart.E.CFF202CB”?

The Generic.Servstart.E.CFF202CB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Servstart.E.CFF202CB virus can do?

Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Uses Windows utilities for basic functionality
CAPE detected the Nitol malware family
Creates a copy of itself
Anomalous binary characteristics

How to determine Generic.Servstart.E.CFF202CB?


File Info:
name: E3F70FCCEA3880833150.mlwpath: /opt/CAPEv2/storage/binaries/7d994cfb4705130b83c8cece9a902627784132ba6286c21e6424b7c83479fbd9crc32: 17CD4EB3md5: e3f70fccea388083315015383d361c47sha1: 0bb40745242e2a56d92b5db5a563cfc27c6a1f6csha256: 7d994cfb4705130b83c8cece9a902627784132ba6286c21e6424b7c83479fbd9sha512: d3ce488e979695621c867b18d271ce7428f817b4f06aae7c6c219163b46efc5da627602a5ce4f62b0ee9fa2ccecadc1288789db31ba3abc7cc2b2dcbd9f3d454ssdeep: 3072:v+CUTBfteO6dNnSJEFIY9pMZbjTVyMjku2yvkqsm5QrYcIummV0ViYDd0Gb:XUTBl6XnSJEFTgZz9jkuxc+eYcIumu0Ttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D304390196417467E47340B198E6AF3BA6EE6E740B0E6483F3C87E0A59F47E2763164Fsha3_384: a158c5b2344ff4da52fadbf32aee6823881e408b20babe9247e15305b3be63fae930e01d0172c8bc9e7267d11f991b4cep_bytes: 558bec6aff68085b400068c897420064timestamp: 2014-02-15 02:26:38
Version Info:
Comments: CompanyName: zhensuFileDescription: zhensuFileVersion: 1, 0, 0, 1InternalName: zhensuLegalCopyright: 版权所有(C) 2014LegalTrademarks: OriginalFilename: zhensuPrivateBuild: ProductName: zhensuProductVersion: 1, 0, 0, 1SpecialBuild: Translation: 0x0804 0x04b0

Generic.Servstart.E.CFF202CB also known as:

Lionic	Heuristic.File.Generic.00×1!p
MicroWorld-eScan	Generic.Servstart.E.CFF202CB
FireEye	Generic.mg.e3f70fccea388083
McAfee	Artemis!E3F70FCCEA38
Cylance	Unsafe
VIPRE	Generic.Servstart.E.CFF202CB
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 0054d1101 )
BitDefender	Generic.Servstart.E.CFF202CB
K7GW	Trojan ( 0054d1101 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.34682.lm1@aCHNzZcb
VirIT	Backdoor.Win32.Generic.FIO
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Farfli.ARB
Baidu	Win32.Trojan.Farfli.x
APEX	Malicious
ClamAV	Win.Trojan.Gh0stRAT-9760859-1
Kaspersky	Trojan.Win32.Vehidis.qh
NANO-Antivirus	Trojan.Win32.Vehidis.ctwwch
Cynet	Malicious (score: 100)
Rising	Backdoor.Farfli!1.A1B3 (CLASSIC)
Ad-Aware	Generic.Servstart.E.CFF202CB
Emsisoft	Generic.Servstart.E.CFF202CB (B)
Comodo	TrojWare.Win32.Vehidis.PRF@58x08v
DrWeb	Trojan.DownLoader9.27029
TrendMicro	BKDR_ZEGOST.SM40
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Jiangmin	Heur:Backdoor/PcClient
Avira	HEUR/AGEN.1205562
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Generic.ASMalwS.34D8
Microsoft	Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware	Trojan.Agent/Gen-Vehidis
GData	Generic.Servstart.E.CFF202CB
Google	Detected
AhnLab-V3	Trojan/Win32.Vehidis.R94642
VBA32	BScope.Trojan.SvcHorse.01643
ALYac	Generic.Servstart.E.CFF202CB
Malwarebytes	Malware.Heuristic.1004
Panda	Generic Malware
TrendMicro-HouseCall	BKDR_ZEGOST.SM40
Tencent	Win32.Trojan.Vehidis.Aujl
Yandex	Trojan.Vehidis!L4DSvUSK3M8
Ikarus	Backdoor.Win32.Inject
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Farfli.ARU!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.cea388
Avast	Win32:Evo-gen [Trj]