P2P-Worm.Win32.Palevo.hyhu removal

The P2P-Worm.Win32.Palevo.hyhu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What P2P-Worm.Win32.Palevo.hyhu virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• HTTPS urls from behavior.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• Executable file is packed/obfuscated with ASPack
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Checks the CPU name from registry, possibly for anti-virtualization
• Attempted to write directly to a physical drive
• Attempts to modify proxy settings
• Deletes executed files from disk
• Touches a file containing cookies, possibly for information gathering
• Anomalous binary characteristics

How to determine P2P-Worm.Win32.Palevo.hyhu?

File Info:
name: 45C14CDD8E4602AC7256.mlw
path: /opt/CAPEv2/storage/binaries/ce692f338ef306502541a0efdc465ec4aa8f3eb90ef8cdd5c9772a79394e140e
crc32: B90AD75A
md5: 45c14cdd8e4602ac72569a69cbf9d5a2
sha1: 73c1afd87b792b99bfd8e2f2b3fc9dc99aceb221
sha256: ce692f338ef306502541a0efdc465ec4aa8f3eb90ef8cdd5c9772a79394e140e
sha512: 5c7b1a0c8f3370179c74b0289e3f996b8883bd34d545a725d5174ee491bba19d081612d6fb4704a7c8489d157df088105007c31276c5b1ba0d434c18a4bbe155
ssdeep: 6144:lf4/sJYWd+ZO+oTcboiSLhCGnFo7ksYKFn3DqFn9DKD:lf4QlqMT0oignsd3SE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F944236067699B3DDA8C40B6400CEFB57D33AB32A9774BA470DC5A3AFE319FA6500147
sha3_384: 7e8ddbbaa3bcdaaf36dc844318e7d3e592eccc477b147307e2770bec9d0484eda9efb68063902f27297e3e68335b1f41
ep_bytes: 60e803000000e9eb045d4555c3e80100
timestamp: 2015-11-25 04:54:23

Version Info:
0: [No Data]

P2P-Worm.Win32.Palevo.hyhu also known as:

How to remove P2P-Worm.Win32.Palevo.hyhu?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.