PUA:Win32/SCAir removal instruction

The PUA:Win32/SCAir is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/SCAir virus can do?

Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine PUA:Win32/SCAir?


File Info:
crc32: 22ABC56C
md5: e56f702b0e4b614b2b1d36e7e2459429
name: mbox.exe
sha1: 91fcca739bf353091348ef63d83ef71b02ebd19c
sha256: 41f94874c9c2c736fdfe885647fdfeaea09e79e1ae544b9537f90767c3d2b5a5
sha512: eb2109ed7ae7f604855a8ce8a64749e57420dbc667ea3f58b36f34399997924ff07d1d333abaf6591e5d73e70890725f8ec715c8514375f6273bf6341df07f7e
ssdeep: 196608:ByHDK7Rngu9WYDbYSQeayKxl+aPEO21ftydVVK9W3HHY2QfcRq7O1g:ByjKJEYXhwyjQEOQFydVVK9W3ngm1
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2012 x6613x4e91x7f51x7edc
InternalName: mbox
FileVersion: 2.9.9.12
CompanyName: x6c5fx95e8x5e02x6613x4e91x7f51x7edcx6709x9650x516cx53f8
ProductName: x8f6fx4ef6x9b54x76d2
ProductVersion: 2.9.9.12
FileDescription: x8f6fx4ef6x9b54x76d2
Translation: 0x0000 0x03a8

PUA:Win32/SCAir also known as:

Avast	Win32:Malware-gen
Comodo	Malware@#196k9znxfmwdm
Ikarus	Trojan.Agent
Microsoft	PUA:Win32/SCAir
VBA32	TScope.Trojan.Delf
AVG	Win32:Malware-gen

How to remove PUA:Win32/SCAir?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

PUA:Win32/SCAir removal instruction