Graftor.978 malicious file

The Graftor.978 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.978 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Network activity contains more than one unique useragent.
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

www.xiaozhushou.cc

a.tomx.xyz

www.bing.com

How to determine Graftor.978?


File Info:
crc32: F0CAA344
md5: 4c67cadb9f65993cdcdf2ce4d2806116
name: lizhangdkdef.exe
sha1: d8a27643e61ceb34e82be4a53042562f4f32d5a0
sha256: 6ad0db52284c44d28e249a12035a1255778e5aeee4c4a1e3b2175737617ee221
sha512: df0c8d9313e33d4dcfc575a996e3c2bb0b520ccaf1334072d746454982e3f286ce5f2b77457362970b50fc2ef8a24f63d9b07ada958788db675c19868e174e2d
ssdeep: 98304:eFD0m+4iHWvxKrPkwV9R19of/ko0XeKWGCitctabf/lQRn0vR8z8WvaH7m:GYFWgDkwV979of/ko0XeKWGCitctabfy
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x9006x6218x5c0fx52a9x624bx8f85x52a9www.xiaozhushou.cc
FileVersion: 1.0.0.0
CompanyName: www.xiaozhushou.cc
Comments: x9006x6218x5c0fx52a9x624bx8f85x52a9
ProductName: x6613x8bedx8a00x7a0bx5e8f
ProductVersion: 1.0.0.0
FileDescription: x9006x6218x5c0fx52a9x624bx8f85x52a9
Translation: 0x0804 0x04b0

Graftor.978 also known as:

MicroWorld-eScan	Gen:Variant.Graftor.978
McAfee	Generic PUP.u
Malwarebytes	Trojan.FlyStudio
K7AntiVirus	Riskware
K7GW	Riskware
NANO-Antivirus	Trojan.Win32.Genome.bibflo
F-Prot	W32/Agent.EW.gen!Eldorado
Symantec	WS.Reputation.1
Norman	Siscos.O
TotalDefense	Win32/Oflwr.A!crypt
TrendMicro-HouseCall	TROJ_SPNR.0BBJ13
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Genome.akhog
BitDefender	Gen:Variant.Graftor.978
Agnitum	Trojan.Genome!MWHrWyGMFrM
Sophos	Mal/Generic-S
Comodo	Worm.Win32.Dropper.RA
F-Secure	Trojan:W32/DelfInject.R
TrendMicro	TROJ_SPNR.0BBJ13
McAfee-GW-Edition	Generic PUP.u
Emsisoft	Gen:Variant.Graftor.978 (B)
Kingsoft	Win32.Troj.Generic.a.(kcloud)
Microsoft	Trojan:Win32/Dynamer!dtc
AhnLab-V3	Win-Trojan/ASD.variant
GData	Gen:Variant.Graftor.978
Commtouch	W32/Agent.EW.gen!Eldorado
VBA32	Trojan.Genome.ak
ESET-NOD32	a variant of Win32/FlyStudio
Ikarus	Backdoor.Win32.BlackHole
Fortinet	W32/Flystudio
AVG	PSW.OnlineGames4.AGDQ
Panda	Generic Malware

How to remove Graftor.978?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Graftor.978 malicious file