Malware

Should I remove “Malware.AI.4211396341”?

Malware Removal

The Malware.AI.4211396341 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4211396341 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • A file was accessed within the Public folder.
  • Uses Windows utilities for basic functionality
  • Installs a browser addon or extension
  • Attempts to modify Internet Explorer’s start page
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is likely packed with VMProtect
  • Authenticode signature is invalid
  • Binary file triggered YARA rule
  • Deletes executed files from disk
  • The sample wrote data to the system hosts file.
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Malware.AI.4211396341?


File Info:

name: 646B5BE14562E52494BF.mlw
path: /opt/CAPEv2/storage/binaries/f8506696051184fa7379a8aab0001c630852990eef3e4897af3bb75825d74000
crc32: F64045C5
md5: 646b5be14562e52494bf707af3fe383e
sha1: fb2076fcb78dc82fadd54cc9898b695d4fb86e41
sha256: f8506696051184fa7379a8aab0001c630852990eef3e4897af3bb75825d74000
sha512: b75c6682d90871bd5a927a1cd2f8b2c3ba3d78afe1d6d4c234440b24b3a2fe6975d559e6c92dd2778ae091effeae687855057e5494099e1de880697c5bd2222c
ssdeep: 6144:yDLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:qQCyQ1LHk+zR7QHjGo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19A4423491D8A8875F8CF3B3CB9218E0FF4991891CBBA4D67FB904A1215BB9A2540F674
sha3_384: 0890b91e688bd173a9e5e7d1538155fa4392ff1b72e26dc46e989e982d998db0c1fe9e49075f215b30a8360a019a6553
ep_bytes: 684a819ac3e88b780300e860dcffff00
timestamp: 2009-09-03 09:11:34

Version Info:

0: [No Data]

Malware.AI.4211396341 also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Generic.l4uJ
Elasticmalicious (high confidence)
DrWebTrojan.Click1.63762
MicroWorld-eScanDeepScan:Generic.Startpage.EFD4F969
FireEyeGeneric.mg.646b5be14562e524
CAT-QuickHealTrojan.StartpageRI.S27477470
SkyhighBehavesLike.Win32.Generic.dc
McAfeeBackDoor-CKB.gen.bf
MalwarebytesMalware.AI.4211396341
ZillyaTrojan.Qhost.Win32.2781
SangforPUP.Win32.StartPage.Vcc1
K7AntiVirusHacktool ( 005287aa1 )
AlibabaTrojan:Win32/Startpage.75fe348c
K7GWHacktool ( 005287aa1 )
Cybereasonmalicious.14562e
BitDefenderThetaGen:NN.ZexaF.36802.qCW@a0AaDVl
VirITTrojan.Win32.Generic.AFI
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/Qhost.NRF
APEXMalicious
TrendMicro-HouseCallMal_PClnt-4
ClamAVWin.Trojan.Qhost-156
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderDeepScan:Generic.Startpage.EFD4F969
AvastWin32:Evo-gen [Trj]
TencentWin32.Trojan.Qhost.Qcnw
EmsisoftDeepScan:Generic.Startpage.EFD4F969 (B)
F-SecureTrojan.TR/Qhost.kudud
VIPREDeepScan:Generic.Startpage.EFD4F969
TrendMicroMal_PClnt-4
Trapminemalicious.moderate.ml.score
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
MAXmalware (ai score=89)
JiangminTrojan/Qhost.bfc
GoogleDetected
AviraTR/Qhost.kudud
VaristW32/Risk.HLQZ-1731
Antiy-AVLTrojan/Win32.Qhost
Kingsoftmalware.kb.b.902
MicrosoftTrojan:Win32/Startpage.GG
ArcabitDeepScan:Generic.Startpage.EFD4F969
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataDeepScan:Generic.Startpage.EFD4F969
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Qhost.R25024
VBA32Trojan.Qhost
ALYacDeepScan:Generic.Startpage.EFD4F969
Cylanceunsafe
RisingTrojan.Win32.StartPage.ndb (CLASSIC)
IkarusTrojan.Win32.Qhost
MaxSecureTrojan.Malware.1851422.susgen
FortinetW32/StartPage.NNY!tr
AVGWin32:Evo-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_70% (D)
alibabacloudTrojan.Win.Hosts2.0f148583

How to remove Malware.AI.4211396341?

Malware.AI.4211396341 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment