Categories: Malware

Heur.PWSIME.1 removal instruction

The Heur.PWSIME.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Heur.PWSIME.1 virus can do?

Attempts to connect to a dead IP:Port (4 unique times)
At least one IP Address, Domain, or File Name was found in a crypto call
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

www.69sw.net

www.9369.org

www.qmww.net

a.tomx.xyz

js.users.51.la

n.sinaimg.cn

www.abcwm.net

How to determine Heur.PWSIME.1?


File Info:
crc32: 9F190D69md5: 9663470e49614f66176a0167723c2b01name: cfxcfzzxb_ttrar.exesha1: 7c9862cd0f1445e56152c9a2c714982ae4473894sha256: 42371275412c3a88e46363f9ddf4b90fb15ef421c3faaf37525e2ccd3f1d6726sha512: 0ca389b730e144da36f61094b7d800a996e4b9b9bef45f41ad6cfc9c1cfb7fa2dcd4a4ce0e11f95287a9c4779a550151e00348753a793353aa8a615fbcd50d09ssdeep: 12288:B2YTWmmKsbwdpF5w1Y284Oxs8Oop6Yqp63wqUVHx+Ia6n0/icx6u08vGl:3TWJKsupI1/PE5zqnhbcie66+ltype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Heur.PWSIME.1 also known as:

Bkav	HW32.Packed.
DrWeb	Trojan.Packed.29312
MicroWorld-eScan	Gen:Heur.PWSIME.1
McAfee	GenericRXJC-LE!9663470E4961
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0038d0af1 )
BitDefender	Gen:Heur.PWSIME.1
K7GW	Trojan ( 0038d0af1 )
Cybereason	malicious.e49614
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34108.UqW@a40Ftmfb
F-Prot	W32/IMEStartup.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:GenMalicious-AXO [Trj]
GData	Gen:Heur.PWSIME.1
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:Win32/Tiggre.2cb7fc5c
NANO-Antivirus	Trojan.Win32.Agent.driasq
AegisLab	Trojan.Win32.Generic.lr6U
Tencent	Win32.Trojan.Generic.Htbv
Endgame	malicious (high confidence)
Sophos	Generic PUA HM (PUA)
Comodo	TrojWare.Win32.Packed.EXC@4xl9h8
F-Secure	Heuristic.HEUR/AGEN.1121781
Baidu	Win32.Trojan-GameThief.OnlineGames.h
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
MaxSecure	Trojan.Malware.2588.susgen
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.9663470e49614f66
Emsisoft	Gen:Heur.PWSIME.1 (B)
Ikarus	Trojan.SuspectCRC
Cyren	W32/IMEStartup.A.gen!Eldorado
Jiangmin	Trojan.Generic.lujb
Webroot	W32.Backdoor.Gen
Avira	HEUR/AGEN.1121781
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.Tgenic
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.PWSIME.1
ZoneAlarm	HEUR:Trojan.Win32.Generic
ALYac	Gen:Heur.PWSIME.1
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
Rising	Trojan.Win32.Fednu.tpt (CLOUD)
SentinelOne	DFI – Suspicious PE
eGambit	Generic.Malware
Fortinet	W32/Onlinegames.AJFWY!tr
Ad-Aware	Gen:Heur.PWSIME.1
AVG	Win32:GenMalicious-AXO [Trj]
CrowdStrike	win/malicious_confidence_100% (W)