Categories: Malware

PWS:Win32/Lineage.Y removal guide

The PWS:Win32/Lineage.Y is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Lineage.Y virus can do?

Creates RWX memory
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PWS:Win32/Lineage.Y?


File Info:
name: 336B17FDE71CEF1AC701.mlwpath: /opt/CAPEv2/storage/binaries/a0cb51c90e3ad34147fd8ab8af8007c6c555c9b13badef225aa1a0e403bd8befcrc32: 5BAD2EA8md5: 336b17fde71cef1ac701fbd50975e5dasha1: 10bd544fb9f79f1d9aa844ffc5efc1664200cc6csha256: a0cb51c90e3ad34147fd8ab8af8007c6c555c9b13badef225aa1a0e403bd8befsha512: c2d01b5368cb2063e0ec91e5dfdea72d7f8e1eeead03e213246dd6f08b705518bdc31d662dd83b52c3af56587f505daad9c9ef486c312643bd10ee5f172fddefssdeep: 12288:u+SpTHOvmPcyMsMoYoMC14xhg3l/OqS0xj:BIquV4I34Gtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T101C45D22B7E09433C16316798C1B876CA936BE113D2969863BF53E4C5F3D781392B297sha3_384: 83e3520024fd229b1b59acda86babcb66809cccc9c5cc61fc3afa64328bc149c81e9e86495a7dd3feb52b808e412603cep_bytes: 558bec83c4f0b8ace04500e8a87afafftimestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

PWS:Win32/Lineage.Y also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Delf.l6O7
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Lineage.9341
MicroWorld-eScan	DeepScan:Generic.Delf.Lineage.4B5BEE25
FireEye	Generic.mg.336b17fde71cef1a
McAfee	PWS-Lineage.a
Cylance	Unsafe
K7AntiVirus	Trojan ( 7000000f1 )
Alibaba	TrojanPSW:Win32/Nilage.c626539f
K7GW	Trojan ( 7000000f1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZelphiF.34294.HmW@aOP0jsib
Cyren	W32/Lineage.XBCH-3638
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/PSW.Lineage.Y
TrendMicro-HouseCall	TSPY_LINEAGE.DLI
Paloalto	generic.ml
Kaspersky	Trojan-GameThief.Win32.Nilage.y
BitDefender	DeepScan:Generic.Delf.Lineage.4B5BEE25
NANO-Antivirus	Trojan.Win32.Nilage.cruust
Avast	Win32:Trojan-gen
Tencent	Trojan.Win32.BitCoinMiner.la
Ad-Aware	DeepScan:Generic.Delf.Lineage.4B5BEE25
Sophos	Mal/Generic-R
TrendMicro	TSPY_LINEAGE.DLI
McAfee-GW-Edition	BehavesLike.Win32.PWSLegMir.hh
SentinelOne	Static AI – Malicious PE
Emsisoft	DeepScan:Generic.Delf.Lineage.4B5BEE25 (B)
Ikarus	Trojan-Dropper.Delf
Jiangmin	Heur:Backdoor/Huigezi
Avira	TR/Dldr.Delphi.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.1C724
Microsoft	PWS:Win32/Lineage.Y
GData	DeepScan:Generic.Delf.Lineage.4B5BEE25
Cynet	Malicious (score: 100)
ALYac	DeepScan:Generic.Delf.Lineage.4B5BEE25
VBA32	MalwareScope.Trojan-PSW.Game.7
Malwarebytes	Malware.AI.1001623987
APEX	Malicious
Rising	Trojan.Generic@ML.98 (RDML:MURkOk8c5FcID88fGWGpgA)
Yandex	Trojan.PWS.Nilage!Jm0pvlo1VYE
MAX	malware (ai score=86)
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/LINEAGE.DLI!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.de71ce
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.300983.susgen