PUA

How to remove “MultiPlug (PUA)”?

Malware Removal

The MultiPlug (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What MultiPlug (PUA) virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Reads data out of its own binary image
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Behavior consistent with a dropper attempting to download the next stage.
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

ringmynorth.biz
allmodel-pro.com
center-ring.info
get-multiple.link

How to determine MultiPlug (PUA)?


File Info:

crc32: A1CBB385
md5: d19266132dddc0c86a590c151810d7b2
name: setup.exe
sha1: 37ccfd595b60469786705d822a3668de6bdc104a
sha256: 559fe2faf40fe61a7d08a3dba94ecce0e7b04a75cdb2f8529715bb107a3b0467
sha512: 2cc5b57ea4655d85c15d9b84aaba656d1e80f09423f92c087f95e90b1ab27acf91d4910a974bd5fdc8fbe660cb2081217f0454ea0008ae8279f7555095d890fb
ssdeep: 3072:hhyPMvGX2gPbH1WPZBeDjR4eZVOnlIZIeEiXbHbTMjTyI2YhtRvcOX6gle2CCBHg:h+Mu7k3E5LOeZ3EiXb7TMjIevNFg
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

MultiPlug (PUA) also known as:

MicroWorld-eScanGen:Variant.Adware.MultiPlug.69
FireEyeGeneric.mg.d19266132dddc0c8
CAT-QuickHealAdware.Installerex.A8
McAfeeMultiPlug
CylanceUnsafe
VIPREMultiPlug (v)
SangforMalware
K7AntiVirusUnwanted-Program ( 004c84181 )
BitDefenderGen:Variant.Adware.MultiPlug.69
K7GWUnwanted-Program ( 004c84181 )
Cybereasonmalicious.32dddc
Invinceaheuristic
BaiduWin32.Adware.Generic.bb
F-ProtW32/S-8fec2e29!Eldorado
SymantecSMG.Heur!gen
APEXMalicious
AvastWin32:MultiPlug-ABB [PUP]
ClamAVWin.Adware.Agent-1305768
GDataWin32.Trojan-Spy.Emotet.DR@gen
KasperskyHEUR:Trojan.Win32.Generic
NANO-AntivirusTrojan.Win32.WebPick.dtnytb
RisingAdWare.Win32.MultiPlug.aq (CLASSIC)
Endgamemalicious (high confidence)
EmsisoftGen:Variant.Adware.MultiPlug.69 (B)
ComodoApplication.Win32.MultiPlug.HE@5su97b
F-SecureTrojan.TR/ATRAPS.Gen
ZillyaAdware.MultiPlug.Win32.354204
McAfee-GW-EditionBehavesLike.Win32.MultiPlug.dh
Trapminemalicious.high.ml.score
SophosMultiPlug (PUA)
IkarusTrojan.Win32.Crypt
CyrenW32/S-8fec2e29!Eldorado
JiangminTrojanDownloader.Agent.ezpz
WebrootPua.Downloadmanager
AviraTR/ATRAPS.Gen
MAXmalware (ai score=65)
Antiy-AVLTrojan[Downloader]/Win32.Agent.hfxr
MicrosoftBrowserModifier:Win32/Diplugem
ArcabitTrojan.Adware.MultiPlug.69
SUPERAntiSpywarePUP.MultiPlug/Variant
ZoneAlarmHEUR:Trojan.Win32.Generic
CynetMalicious (score: 100)
AhnLab-V3PUP/Win32.MultiPlug.R156322
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34128.qyZ@ayobOzhi
ALYacGen:Variant.Adware.MultiPlug.69
VBA32BScope.Trojan.Crossrider
MalwarebytesPUP.Optional.MultiPlug
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Adware.MultiPlug.MZ
TencentMalware.Win32.Gencirc.10b0fa91
YandexPUA.MultiPlug!
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/Generic.AC.1AC122!tr
Ad-AwareGen:Variant.Adware.MultiPlug.69
AVGWin32:MultiPlug-ABB [PUP]
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360HEUR/QVM10.1.CABB.Malware.Gen

How to remove MultiPlug (PUA)?

MultiPlug (PUA) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment