About “MSILPerseus.1044 (B)” infection

The MSILPerseus.1044 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSILPerseus.1044 (B) virus can do?

• Injection (inter-process)
• Injection (Process Hollowing)
• Attempts to connect to a dead IP:Port (1 unique times)
• Creates RWX memory
• Mimics the system’s user agent string for its own requests
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• Performs some HTTP requests
• Uses Windows utilities for basic functionality
• Executed a process and injected code into it, probably while unpacking
• Deletes its original binary from disk
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine MSILPerseus.1044 (B)?

File Info:
crc32: 8F517464
md5: ecadea47fa2c3c01415a05dfdeadba88
name: ECADEA47FA2C3C01415A05DFDEADBA88.mlw
sha1: 09768b1728019de72ff2fd1a3c2808a87688bd8e
sha256: 266470ef0074a35afab81c0b64111b46be701a848b18e0d3c7959b719fbb2dbc
sha512: d59181b6cd0b5ffe600863386c16af5b27e7b610392ff9b77b748c18872f5217193cb9a0c901039182bdce278ad7ab8313553cdef85299b5d2fe921aa658786a
ssdeep: 3072:clCekN7R27o4rzTJVaO+cWy9JezP4kc7dJGnKYVNVI:AklR0Ff9VajcDkOGKED
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  x1e12x43cx3cex417x4e7x4e88x435x44cx9aa8x9aa8x40ax1e08x416x409x1e06x43cx43ex43ex4e9x4e8ax304fx9802x49ex43bx435x44ax3072x96e3x9802x417  2014 
Assembly Version: 1.2.3.4
InternalName: Server.exe
FileVersion: 5.6.7.8
CompanyName: x44cx3046x3dfx3046x4b6x416x43bx4d4x4b6x4b6x416x4e9x416x1e08x1e12x440x437x9802x304ax4e89x9aa8x430x437x4e88x43ax4e0ex1e08x304fx3078x49e
LegalTrademarks: 
Comments: x442x443x3053x3075x43cx409x43ex3051x3044x430x443x442x9aa8x49bx435x1ea6x304ax304fx44ax3d0x307fx3dfx9aa8x49bx9769x3c9x4e8x44ax43cx4e0e
ProductName: x9aa8x417x3dfx4e8bx3cex430x49bx44ax426x417x44cx40ax3dfx1e08x1e12x43ex43bx441x9802x307ex3075x40ax430x4e94x9802x4e89x304ax44cx3cex307f
ProductVersion: 5.6.7.8
FileDescription: x1e12x43cx3cex417x4e7x4e88x435x44cx9aa8x9aa8x40ax1e08x416x409x1e06x43cx43ex43ex4e9x4e8ax304fx9802x49ex43bx435x44ax3072x96e3x9802x417
OriginalFilename: Server.exe

MSILPerseus.1044 (B) also known as:

How to remove MSILPerseus.1044 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.