Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

Mikey.166133 removal tips

Published May 6, 2024 Malware category 3 min read
Report context

What to verify before removal

This report keeps Mikey.166133 removal tips in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

Start by comparing the local file name with 94D06287683E7AB2F4A5.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
94D06287683E7AB2F4A5.mlw
  • Compare the suspicious file name with 94D06287683E7AB2F4A5.mlw.
  • Confirm the detection name matches Mikey.166133 removal tips before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The Mikey.166133 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Mikey.166133 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Turkish
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Attempted to write directly to a physical drive
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Mikey.166133?



File Info:

name: 94D06287683E7AB2F4A5.mlw
path: /opt/CAPEv2/storage/binaries/7b56045f988b0e3d74d634f2ef560609f1533a7c97a3c22e90fd47ed1fd324c5
crc32: E489D68F
md5: 94d06287683e7ab2f4a5131e9eb72277
sha1: 6c1217744e212a5a2b2469cc4e3dd847e29c2308
sha256: 7b56045f988b0e3d74d634f2ef560609f1533a7c97a3c22e90fd47ed1fd324c5
sha512: e7f3de8517e3f31791208f0ca1f22e529788fe651ea057b9b58b4071a408debde5afdf8bd10fb739ccc2add9e98cf80691e9822767cb623043bcc0abf5583cb3
ssdeep: 6144:DeI/kKebk9rCTvvKw6uZG9DKeJFflo3VjqGePbP4DUdihb+XNwCr7qkcE94deZCp:iIleg9rRw6OG9DKKFflw7ezub+qqekE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E9C40110B660DC31EC660BB789E5D694DB2ABDF2B7B8914E715436EF2E732D0801E352
sha3_384: af79424e21d52fe78ae937dd3c454bd91d4e3a423b2671162206d32d1cdf69ee9b8eafae1d651136fe6b0f8c91ab9d9d
ep_bytes: e8ca570000e978feffffcccccccccccc
timestamp: 2022-11-12 05:52:18


Version Info:

FileVersions: 13.1.8.50
ProductVersion: 26.71.13.2
InternalName: Change
LegalCopyrights: Nevermore
CompanyNames: Sword
Translation: 0x010b 0x04e2

Mikey.166133 also known as:

Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Mikey.166133
FireEye Generic.mg.94d06287683e7ab2
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Lockbit.hc
McAfee Artemis!94D06287683E
Malwarebytes Trojan.MalPack.GS
Sangfor Ransom.Win32.Save.a
BitDefenderTheta Gen:NN.ZexaF.36804.Kq0@aGWQ!UiG
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HWZP
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Windigo-10028444-0
Kaspersky HEUR:Trojan-PSW.Win32.Stealerc.gen
BitDefender Gen:Variant.Mikey.166133
Avast Win32:RansomX-gen [Ransom]
Emsisoft Gen:Variant.Mikey.166133 (B)
Trapmine malicious.high.ml.score
Sophos Troj/Krypt-AEE
Ikarus Trojan.Gluteba
Google Detected
Varist W32/FakeAlert.VV.gen!Eldorado
Kingsoft malware.kb.a.998
Microsoft Trojan:Win32/Sabsik.FL.A!ml
Arcabit Trojan.Mikey.D288F5
ZoneAlarm HEUR:Trojan-PSW.Win32.Stealerc.gen
GData Win32.Packed.Kryptik.4OBZL4
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R647065
VBA32 BScope.TrojanSpy.Convagent
MAX malware (ai score=84)
Cylance unsafe
Rising Ransom.Stop!8.10810 (TFE:5:d5w3aWYNT9F)
SentinelOne Static AI – Malicious PE
Fortinet W32/Kryptik.HCOV!tr
AVG Win32:RansomX-gen [Ransom]
DeepInstinct MALICIOUS

How to remove Mikey.166133?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.