Categories: PUA

How to remove “PUA:Win32/FileTourInstaller”?

The PUA:Win32/FileTourInstaller is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/FileTourInstaller virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

Related domains:

ec2-52-59-248-204.eu-central-1.compute.amazonaws.com

How to determine PUA:Win32/FileTourInstaller?


File Info:
crc32: ADDEF803md5: 82ac7aa0197634ff83110faca03573a4name: 82AC7AA0197634FF83110FACA03573A4.mlwsha1: 1f585fa213e29ca17fb168f94c42cb9ed491c69asha256: dd81551919a7216ea66eaa3a6b67c8bc82d231deb87bcd95267ffba0778e6a96sha512: 43b7df9c44bfc6357c894f36e5be16fa2873b783fa173d167fe7488e70b2867a537b80bbcf98055959d55393f1d57760e24fda9505890e2f231d3d5003f3e0d1ssdeep: 49152:Q3TOktB4JXx32Bk9Nk3W05Z+eZzgzrVAtJv0++y0N3:PMWpm1zgzxAtJvFUN3type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: InternalName: FileVersion: 1.9.2.0CompanyName: Country: ProductName: ProductVersion: FileDescription: Release: FinalOriginalFilename: Translation: 0x0409 0x04b0

PUA:Win32/FileTourInstaller also known as:

Bkav	W32.AIDetectVM.malware5
Elastic	malicious (high confidence)
DrWeb	Trojan.Ticno.1430
MicroWorld-eScan	Gen:Variant.Application.Bundler.FileTour.69
FireEye	Generic.mg.82ac7aa0197634ff
CAT-QuickHeal	PUA.Apbsoft.Gen
ALYac	Gen:Variant.Application.Bundler.FileTour.69
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
BitDefender	Gen:Variant.Application.Bundler.FileTour.69
Cybereason	malicious.019763
BitDefenderTheta	AI:Packer.59B2C9B120
Symantec	PUA.Gen.2
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
NANO-Antivirus	Trojan.Win32.Ticno.eaytlj
Tencent	Malware.Win32.Gencirc.10b2f21d
Ad-Aware	Gen:Variant.Application.Bundler.FileTour.69
Emsisoft	Application.AdFile (A)
Comodo	Application.Win32.FileTour.DBM@6i2rrn
Zillya	Adware.FileTourCRT.Win32.49
McAfee-GW-Edition	Artemis!PUP
Sophos	Generic PUA BP (PUA)
Ikarus	PUA.FileTour
Jiangmin	AdWare.Generic.fcdv
Avira	HEUR/AGEN.1119617
Antiy-AVL	Trojan/Win32.TSGeneric
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	PUA:Win32/FileTourInstaller
Arcabit	Trojan.Application.Bundler.FileTour.69
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Application.Bundler.FileTour.69
AhnLab-V3	PUP/Win32.FileTour.R183588
Acronis	suspicious
McAfee	Artemis!82AC7AA01976
MAX	malware (ai score=76)
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Malware.AI.2545449869
APEX	Malicious
ESET-NOD32	a variant of Win32/Adware.FileTour.DBM
Rising	Trojan.Generic@ML.91 (RDMK:cukoK3Ck4N/X2z/duA6uzA)
Yandex	PUA.FileTour!MbPb0tF4T14
SentinelOne	Static AI – Malicious PE – Adware
Fortinet	W32/Filecoder.FV!tr.ransom
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Application.10a