About “Mal/Generic-R + Mal/QQPass-O” infection

The Mal/Generic-R + Mal/QQPass-O is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Mal/Generic-R + Mal/QQPass-O virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Mal/Generic-R + Mal/QQPass-O?


File Info:
name: 734E2D09A73D9FFD5157.mlw
path: /opt/CAPEv2/storage/binaries/1719315e99d2b2e7ec3695c88444a39a8f3b0c5312d48b867f5bca40fc2f09b3
crc32: 97FD4EF1
md5: 734e2d09a73d9ffd515761d1449dd98e
sha1: 4f4d6bd58865ea7386e325f2f613d1b7f11e3a97
sha256: 1719315e99d2b2e7ec3695c88444a39a8f3b0c5312d48b867f5bca40fc2f09b3
sha512: 0be48dd3f967fbfc5c8912f10d2601a367381442c7c039cdf949aef67dc357e9f6cd79e8079f68520b8eb8a124ee97e6fafa8b5851edbff4da4ca02b6b191366
ssdeep: 768:80vdNL9vUupWcNa8Zz5iQlmxJuoKgPvkHVyXU:80vdNLtUuFNa8Zz5iQlmxooKgXk1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137731AA12E32481EC96E1F3677E45615E6A18849132E8B343F8CD02FEF912854E7DF97
sha3_384: 92cb585b238fd3a47c3891e182336ee3fccad6663b4e86ed5cce11a76cc09b797e25bbdd5ca3d5a34c33bc5bf40aedc9
ep_bytes: 60be00d047008dbe0040f8ff57eb0b90
timestamp: 2015-01-28 13:36:24

Version Info:
0: [No Data]

Mal/Generic-R + Mal/QQPass-O also known as:

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Trojan.Agent.DQQW
ClamAV	Win.Malware.Dqqw-9951425-0
FireEye	Generic.mg.734e2d09a73d9ffd
McAfee	RDN/Generic PWS.y
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005630c11 )
K7GW	Trojan ( 005630c11 )
Cybereason	malicious.9a73d9
Cyren	W32/S-d61125ea!Eldorado
Symantec	SMG.Heur!gen
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Generik.NMAGCSY
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Agent.DQQW
Avast	Win32:Evo-gen [Trj]
Ad-Aware	Trojan.Agent.DQQW
Emsisoft	Trojan.Agent.DQQW (B)
Comodo	Packed.Win32.MUPX.Gen@24tbus
VIPRE	Trojan.Agent.DQQW
McAfee-GW-Edition	BehavesLike.Win32.Dropper.lz
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-R + Mal/QQPass-O
SentinelOne	Static AI – Suspicious PE
GData	Trojan.Agent.DQQW
Jiangmin	Trojan.Generic.hdvty
Avira	TR/PSW.QQSteal.boeu
Antiy-AVL	Trojan/Generic.ASMalwS.50E6
Microsoft	PWS:Win32/Zbot!ml
Google	Detected
AhnLab-V3	Trojan/Win32.Agent.R135706
ALYac	Trojan.Agent.DQQW
MAX	malware (ai score=85)
Malwarebytes	QQpass.Trojan.Stealer.DDS
Rising	Trojan.Kryptik!1.BC24 (CLASSIC)
Yandex	Trojan.Agent!7yhb1Blv7C8
Ikarus	Trojan.PSW.QQSteal
MaxSecure	Trojan.Malware.6934089.susgen
Fortinet	W32/ULPM.16C0!tr
BitDefenderTheta	Gen:NN.ZexaF.34698.emW@amVQ95
AVG	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Mal/Generic-R + Mal/QQPass-O?

Mal/Generic-R + Mal/QQPass-O removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X