Categories: PUA

PUP.Optional.BSDownloader removal guide

The PUP.Optional.BSDownloader is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUP.Optional.BSDownloader virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Creates RWX memory
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine PUP.Optional.BSDownloader?


File Info:
name: DC5C82C78CAA72773BD1.mlwpath: /opt/CAPEv2/storage/binaries/c12fb2ac5221b9e950a746f9e2ed2e2c491c3e2b8009fd6d3cb03706d2ba817ccrc32: D44D9EACmd5: dc5c82c78caa72773bd128d1f2c59050sha1: 7777fbff879ffabdd4c7a4fdc9f1aa9aee42656bsha256: c12fb2ac5221b9e950a746f9e2ed2e2c491c3e2b8009fd6d3cb03706d2ba817csha512: 3369c6691d13deb844cd23c9a1b050aff5823a49afc08e676b3c603dbb4dd0ac1c80ba491a827477fe3a11120310b7a2f97f24fce313024b4c0a2758b9c72443ssdeep: 12288:OZ5vrSGq8r8bH12zt9kIl7lVTMtmx+s9Er2cDsFr+ZiltVBOlvVG7gBllggGW5HJ:OT3lYb8zIXYrFrFsSQdrVxjeOtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T163E49E13B3CBC076D1B221B1595E6B37AA77BA00573285C766D41A8E6E306F14F3E392sha3_384: 07f548fe589ac58c84b8ab28465779d77bbfa8709dfb157b37fb18d3326cd70b408d451598ace0232a0cb7e634f3e5a0ep_bytes: e805050000e937fdffffcccccccccccctimestamp: 2013-03-28 03:24:33
Version Info:
FileDescription: BSdownloader ModuleFileVersion: 1, 0, 0, 3InternalName: BSdownloaderLegalCopyright: Copyright 2011OriginalFilename: BSdownloader.exeProductName: BSdownloader ModuleProductVersion: 1, 0, 0, 3Translation: 0x0409 0x04b0

PUP.Optional.BSDownloader also known as:

Elastic	malicious (high confidence)
DrWeb	Program.BrotherSoft.18
FireEye	Generic.mg.dc5c82c78caa7277
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
Zillya	Adware.BrowseFox.Win32.135260
Sangfor	Riskware.Win32.Wacapew.C
Cyren	W32/BrotherSoft.A.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/BSDownloader potentially unwanted
TrendMicro-HouseCall	PUA.Win32.BSDownloader.SMCGR06
NANO-Antivirus	Riskware.Win32.BrotherSoft.ebqakp
ViRobot	Adware.Bsdownloader.673976.I
Sophos	Generic ML PUA (PUA)
F-Secure	PotentialRisk.PUA/DownBro.Gen7
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	PUA.Win32.BSDownloader.SMCGR06
McAfee-GW-Edition	RDN/Generic Downloader.x
Emsisoft	Application.AdLoad (A)
SentinelOne	Static AI – Malicious PE
GData	Win32.Application.BSDownloader.B
Jiangmin	Downloader.Agent.ljp
MaxSecure	Trojan.not.a.virus.WIn32.Bsdownloader.b_188355
Avira	PUA/DownBro.Gen7
SUPERAntiSpyware	PUP.BSDownloader/Variant
Microsoft	Trojan:Win32/Wacatac.A!ml
Cynet	Malicious (score: 99)
VBA32	Downloader.Agent
Malwarebytes	PUP.Optional.BSDownloader
APEX	Malicious
Yandex	Riskware.BSDownloader!L56VwuDdWRE
Ikarus	PUA.Downloader
Fortinet	Riskware/BSDownloader
CrowdStrike	win/malicious_confidence_100% (D)