What is “Generik.BUHHIWI”?

The Generik.BUHHIWI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Generik.BUHHIWI virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Generik.BUHHIWI?


File Info:
name: 39EE4B4F2260F99770CC.mlw
path: /opt/CAPEv2/storage/binaries/76b1c7b04b629e2d4c27cc5d58e5287a141889cedf1b5370d2069216c7c5c80b
crc32: 8D29D305
md5: 39ee4b4f2260f99770cca4878768a019
sha1: 10c461b63c1108624f1e9db6451bca2fd4df3e71
sha256: 76b1c7b04b629e2d4c27cc5d58e5287a141889cedf1b5370d2069216c7c5c80b
sha512: abdd8edc5efcc0dfad2d74dab2560c18dc8704ac8999bf55c72ffd280e198b276f96306bf9e4c4eebd956d2eec31bf40d00168ff725c8ae698a30d9e5a82b420
ssdeep: 98304:JCetcB2QGUKrBuIJoMwAEB1f7XLv2n16gTBgMFWkyccpqlKy:E9sQyEIwh1f7qnpBgMFWkyccUl
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A216234FDAD358E1C6DC9974B36921BCA6B18FAF4101B3A710842BE6DF3538E25460E7
sha3_384: 9f3fbb7c574cf1eb4fdc0c042839ac103b1a054e480ed84fc5f76f0adb0bbb07a73fe1fdbdc707f9a7462140743ebbc0
ep_bytes: ff250020400000000000000000000000
timestamp: 1995-08-16 22:05:52

Version Info:
Translation: 0x0409 0x04b0
CompanyName: SterJo Software
FileDescription: Patrolling startup registry entries
LegalCopyright: Copyright © SterJo Software
ProductName: SterJo Startup Patrol
FileVersion: 1.05
ProductVersion: 1.05
InternalName: StartupPatrol
OriginalFilename: StartupPatrol.exe

Generik.BUHHIWI also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.71720643
FireEye	Generic.mg.39ee4b4f2260f997
Malwarebytes	Crypt.Trojan.MSIL.DDS
Zillya	Trojan.Stealer.Win32.170129
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanSpy:MSIL/Stealer.3e955ee6
Cybereason	malicious.f2260f
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.BUHHIWI
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.71720643
Avast	Win32:RATX-gen [Trj]
Rising	Malware.Obfus/MSIL@AI.97 (RDM.MSIL2:GUp99GgTAgdp7KTs3JqZaw)
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Spy.Stealer.zuabw
VIPRE	Trojan.GenericKD.71720643
TrendMicro	TROJ_GEN.R002C0XBS24
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.71720643 (B)
Ikarus	Trojan.MSIL.Crypt
Google	Detected
Avira	TR/Spy.Stealer.zuabw
Varist	W32/ABRisk.TROB-1948
Antiy-AVL	Trojan[Spy]/MSIL.Stealer
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Generic.D4465EC3
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Trojan.GenericKD.71720643
BitDefenderTheta	Gen:NN.ZemsilF.36802.4p0@aGU5ZEni
ALYac	Trojan.GenericKD.71720643
MAX	malware (ai score=86)
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0XBS24
Tencent	Malware.Win32.Gencirc.1403676c
Yandex	Trojan.Agent!vhJZSelJO0s
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AKYR!tr
AVG	Win32:RATX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Generik.BUHHIWI?

Generik.BUHHIWI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X