PUP.Optional.RemoveITPro.Generic information

The PUP.Optional.RemoveITPro.Generic is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUP.Optional.RemoveITPro.Generic virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates an indicator observed in Territorial Disputes report SIG40
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Attempts to modify proxy settings

How to determine PUP.Optional.RemoveITPro.Generic?

File Info:
name: A1C79568E635B5CF843F.mlw
path: /opt/CAPEv2/storage/binaries/4ee7cf4fd8e508fc0ce34c758a8fd73ebf9d33a4ebe1fe5490002cc3d73983d1
crc32: 206AE580
md5: a1c79568e635b5cf843f9133537d41e6
sha1: 1552de5ea90fe25c55202ea0ab3db6daeb816bb1
sha256: 4ee7cf4fd8e508fc0ce34c758a8fd73ebf9d33a4ebe1fe5490002cc3d73983d1
sha512: 27f5b11f943845413373633c8c367ef4babb3e8b889d60ab3e432111bc8576685e1563c55bc8544f680f11f562e720ec2b1f95c8cd11aeba604a867965212ec0
ssdeep: 196608:Z0PGdIBRO+aDnqlJZ9HWo7+3Podfn7qVMWiw:Z0GaBjaDQWo7+AhmM9w
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14986332341AAF6B5C115DCF944B4C7537768B172B94660E9223C7ACEABED292C063F60
sha3_384: 12b2d2cbf2d476f39aab845da19bf147fc30dd8e838e9ede6b9124ee483c7e03cc0560dbf0a01a5feb23ea5668343b88
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: InCode Solutions                                            
FileDescription: RemoveIT Pro Enterprise Setup                               
FileVersion:                     
LegalCopyright: InCode Solutions                                                                                    
ProductName: RemoveIT Pro Enterprise                                     
ProductVersion: 16.16                                             
Translation: 0x0000 0x04b0

PUP.Optional.RemoveITPro.Generic also known as:

How to remove PUP.Optional.RemoveITPro.Generic?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.