PUA:Win32/AirInstall removal instruction

The PUA:Win32/AirInstall is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/AirInstall virus can do?

• Sample contains Overlay data
• HTTPS urls from behavior.
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine PUA:Win32/AirInstall?

File Info:
name: 961EB3CF45D26943107F.mlw
path: /opt/CAPEv2/storage/binaries/ef76620fb0c00d6cdfb8081951f5107ab22346e56384807359a83a34cd609fe7
crc32: B5B66933
md5: 961eb3cf45d26943107f6a066d8f753c
sha1: 8ee3a353cfe63c93040720b874c963266f5d3039
sha256: ef76620fb0c00d6cdfb8081951f5107ab22346e56384807359a83a34cd609fe7
sha512: f7112075756704ba8b79a1275f36ee1100119ef42022b74d069a34eb56d71007cc43dbfc7007c0ed9223c7b94128023d4fd77124614121064eb4065e49e93786
ssdeep: 24576:/NA3R5drXPrf/JRg+4y1KeZ83idLctouDIdP2k:i5j/Nd1fZ83Vop52k
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13D351201BAD180B1D6332D332939AB1479BD7D602E25CA6FB3E45E2DDA30151A739B73
sha3_384: 1836e2f7cf6414cb4d7c30fa9b7f9b73c54e8267bdafa32a7d4742878c9c4662f18008f81d48a9df070158da09063ea9
ep_bytes: e85a040000e98efeffff3b0dc8a14300
timestamp: 2019-04-27 20:03:27

Version Info:
0: [No Data]

PUA:Win32/AirInstall also known as:

How to remove PUA:Win32/AirInstall?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.