MemScan:Trojan.Generic.6542806 removal

The MemScan:Trojan.Generic.6542806 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MemScan:Trojan.Generic.6542806 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Catalan
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Creates a copy of itself
• Deletes executed files from disk
• Anomalous binary characteristics

How to determine MemScan:Trojan.Generic.6542806?

File Info:
name: 7AFF01D5832581A4C7F6.mlw
path: /opt/CAPEv2/storage/binaries/1159c2be368130e38bc0f8721fe8a8d9effd264038f17a74f494133df1e97e84
crc32: 96DAEDAA
md5: 7aff01d5832581a4c7f679502d68157f
sha1: 0a1a6cc8719ba5898f8b4154c3a09a860df1e088
sha256: 1159c2be368130e38bc0f8721fe8a8d9effd264038f17a74f494133df1e97e84
sha512: 9869a9175b61aa84065de169c9d064f20caf2c05d1f3c6eb2be9aa69b8e26bc560544cedc2d3b8aa021137569344b4313f4cd341a6e66f57e26e51cbd8ff74e7
ssdeep: 3072:lBZMw05Fe9GQUVDIi1Aj2fhKxLLs80Yb85:lBT0tQUVLajacYd/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198A3124BAABD5672F1D227300D824F1FB52CDE05681AC62F76A29824B714611CF71AFF
sha3_384: f0c66969363cdd8de1828a380357ac8359c069570400fdc928b4d5e466ad95733fd79ab93dd88e45d40176d6bea04105
ep_bytes: b8f83846005064ff3500000000648925
timestamp: 2011-08-03 18:00:26

Version Info:
CompanyName: BreakPoint Software
FileDescription: Hex Workshop v6.5 Installer
FileVersion: 6.5.0.5050
InternalName: hw_v6.5.0.5050
LegalCopyright: Copyright (C) BreakPoint Software
OriginalFileName: hw_v6.5.0.5050.exe
ProductName: Hex Workshop v6.5
ProductVersion: 6.5.0.5050
Translation: 0x0409 0x04b0

MemScan:Trojan.Generic.6542806 also known as:

How to remove MemScan:Trojan.Generic.6542806?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.