How to remove “PWS:Win32/Frethog.AD”?

The PWS:Win32/Frethog.AD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:Win32/Frethog.AD virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine PWS:Win32/Frethog.AD?


File Info:
name: ABF722DC28ADFBB0B6F4.mlw
path: /opt/CAPEv2/storage/binaries/9d1a5f878fcc33c7ac624cc9483eb06fcfe31edc721ade7413ea15053e907da2
crc32: D56A4DFD
md5: abf722dc28adfbb0b6f4acf05d469324
sha1: d01cabdc003da90d3c5dca4e21c85238dd06f9d2
sha256: 9d1a5f878fcc33c7ac624cc9483eb06fcfe31edc721ade7413ea15053e907da2
sha512: 7ccece6c16a7b856333b14d570f913c2f9fe5603092207bbbd3a7a70c79e052e86430889725881f55f5a040b32e24f11e772a65e2066b686d508ac9592d22eab
ssdeep: 768:eZXI5TXI5PQ3DRdcsMV6adx1oHIUF36KDhyWkk5YiHpQQNIhFCAl:eKzRM9cECrrSME
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F9537C4B3B6A5173C3D946343559AB3A8FFF98352A6894D3CF3383D9187A19A943420B
sha3_384: 8165872b08e39ffada883df482d47f01ff28e3245fff48a25ce4b4c94018f943866e334a2a53e70ebe93e5a0ebc6e105
ep_bytes: 558bec6aff680821400068a01a400064
timestamp: 2008-04-17 12:20:24

Version Info:
0: [No Data]

PWS:Win32/Frethog.AD also known as:

Bkav	W32.AIDetectMalware
DrWeb	Trojan.PWS.Wsgame.4586
ClamAV	Win.Spyware.33053-1
McAfee	GenericRXPA-WB!ABF722DC28AD
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 004bcce41 )
K7AntiVirus	Trojan ( 004bcce41 )
BitDefenderTheta	Gen:NN.ZexaF.36662.dmX@aWAt5Bp
Symantec	Infostealer.Gampass
Elastic	malicious (moderate confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-GameThief.Win32.OnLineGames.abci
Avast	Win32:OnLineGames-DOL [Trj]
F-Secure	Trojan.TR/Patched.Ren.Gen
Baidu	Win32.Trojan-PSW.OLGames.bl
TrendMicro	TROJ_GEN.R011C0DIB23
McAfee-GW-Edition	BehavesLike.Win32.Generic.km
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.abf722dc28adfbb0
Sophos	Mal/Behav-191
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/PSW.OnLineGames.afjx
Webroot	Trojan.Gen
Avira	TR/Patched.Ren.Gen
Xcitium	TrojWare.Win32.Magania.~gen@f80ul
ZoneAlarm	Trojan-GameThief.Win32.OnLineGames.abci
Microsoft	PWS:Win32/Frethog.AD
Google	Detected
Acronis	suspicious
VBA32	MalwareScope.Trojan-PSW.Game.1
TrendMicro-HouseCall	TROJ_GEN.R011C0DIB23
Yandex	Trojan.DL.OnlineGames.Gen.78
Ikarus	Trojan-GameThief.Win32.OnLineGames
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:OnLineGames-DOL [Trj]
DeepInstinct	MALICIOUS

How to remove PWS:Win32/Frethog.AD?

PWS:Win32/Frethog.AD removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X