Graftor.49539 removal instruction

The Graftor.49539 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Graftor.49539 virus can do?

Reads data out of its own binary image
Unconventionial language used in binary resources: Korean
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Graftor.49539?


File Info:
name: 29F91EA1B155D207EF98.mlw
path: /opt/CAPEv2/storage/binaries/a59e96084029e4f872ee2cfe5b012a25e40f5eb2cd8976260911d28c2a0960dd
crc32: 4BA0E72A
md5: 29f91ea1b155d207ef98e6b8c680359e
sha1: fb454f0cf4660118065c608bfb9a113ffbd4953f
sha256: a59e96084029e4f872ee2cfe5b012a25e40f5eb2cd8976260911d28c2a0960dd
sha512: aeda9e4f17b020017f53f26dbe6a96280bdcb3688c15fd713ff134caa86cfad07f3eb89110569e01eccddc0ce51ed342dd871092ecaaf09293203bb530ac8909
ssdeep: 1536:E49IoH+qGPLCEMWbImFe7fGfWXfpf3LmwmbvjUgfOGCj5kcOsUJlol:VH+TPLCEM7mIVPL2boSCj5kcOsU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T108E36C317781C032C095103586A7C7B39A3DBD316BA4995BB788EB6E6F313D0EA36359
sha3_384: 5136c0ab3137a5969cefb203680e97b15c6a857678db0d27ecf7527d32ad8de9e8a0db03638782705db00cd63cf56f2c
ep_bytes: e8db640000e979feffff8bff558bec81
timestamp: 2012-10-31 14:58:54

Version Info:
CompanyName: Microsoft Corperation
FileDescription: Generic Host Process for Win32 Services 
FileVersion: 1, 0, 1, 25
InternalName: Install.exe
LegalCopyright: Copyright (c) Microsoft. All rights reserved.
OriginalFilename: Install.exe
ProductName: Microsoft Windows Operating System
ProductVersion: 1, 0, 1, 25
Translation: 0x0412 0x04b0

Graftor.49539 also known as:

tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Graftor.49539
ClamAV	Win.Trojan.Barys-9754805-0
FireEye	Generic.mg.29f91ea1b155d207
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Gen:Variant.Graftor.49539
Cylance	unsafe
Zillya	Trojan.Generic.Win32.850101
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 0048c2c71 )
K7AntiVirus	Trojan ( 0048c2c71 )
Baidu	Win32.Rootkit.Agent.s
Cyren	W32/Urelas.DO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Urelas.R
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Graftor.49539
NANO-Antivirus	Trojan.Win32.Swisyn.csiwzp
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan.Win32.Urelas.ha
TACHYON	Trojan/W32.Swisyn.147456.Y
Emsisoft	Gen:Variant.Graftor.49539 (B)
F-Secure	Trojan.TR/Crypt.FKM.Gen
DrWeb	Trojan.DownLoader7.27838
VIPRE	Gen:Variant.Graftor.49539
McAfee-GW-Edition	BehavesLike.Win32.Trojan.cm
Trapmine	suspicious.low.ml.score
Sophos	Troj/Urelas-AU
Ikarus	Trojan.Win32.Gupboot
GData	Gen:Variant.Graftor.49539
Jiangmin	Trojan.Generic.dlwxq
Avira	TR/Crypt.FKM.Gen
Antiy-AVL	Trojan/Win32.Swisyn
Arcabit	Trojan.Graftor.DC183
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
Microsoft	Trojan:Win32/Urelas.AA
Google	Detected
AhnLab-V3	Trojan/Win32.PbBot.R42541
Acronis	suspicious
McAfee	Generic Malware.mt
MAX	malware (ai score=81)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
Rising	Trojan.Urelas!1.9D87 (CLASSIC)
Yandex	Trojan.Swisyn!NaOf4OcoGEI
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Urelas.D!tr
BitDefenderTheta	Gen:NN.ZexaF.36196.jm0@aKOWcXeO
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.1b155d
DeepInstinct	MALICIOUS

How to remove Graftor.49539?

Graftor.49539 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X