Program:Win32/Ymacco.AAD9 (file analysis)

The Program:Win32/Ymacco.AAD9 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Program:Win32/Ymacco.AAD9 virus can do?

• Executable code extraction
• Injection (inter-process)
• Injection (Process Hollowing)
• Creates RWX memory
• A process created a hidden window
• Unconventionial language used in binary resources: Chinese (Simplified)
• Uses Windows utilities for basic functionality
• Executed a process and injected code into it, probably while unpacking
• Installs itself for autorun at Windows startup
• Anomalous binary characteristics

How to determine Program:Win32/Ymacco.AAD9?

File Info:
crc32: 0F80B002
md5: 081046fc7bda546392e0b3947642d59c
name: 081046FC7BDA546392E0B3947642D59C.mlw
sha1: b2cdd74e9001439f4f96ab2b2755ef7017adbcbc
sha256: d979fc2533c68ed039c97fe9204fd2ee6f066fa9c86520883f02fefb5c4d02b2
sha512: cab054d5ad95c0e84352653c0109e018c9df25d468e219b219201f4ca5679b86c98bd1cf046b5b52a8176e5f60e6f78a0cdde781840b7bf4d0c0a4dfc0417aca
ssdeep: 6144:AI+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHda2:/kvIfnMs596S9a2
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2010
InternalName: Acala Software
FileVersion: 2, 0, 0, 1
CompanyName: Acala Software
ProductName: Acala Encoder Proxy
ProductVersion: 2.0.0.1
FileDescription: Acala Encoder Proxy
OriginalFilename: EncoderProxy.exe
Translation: 0x0409 0x04e4

Program:Win32/Ymacco.AAD9 also known as:

How to remove Program:Win32/Ymacco.AAD9?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.