Categories: Malware

How to remove “PWS:Win32/Lolyda!rfn”?

The PWS:Win32/Lolyda!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Lolyda!rfn virus can do?

Executable code extraction
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
The binary likely contains encrypted or compressed data.
Exhibits behavior characteristic of iSpy Keylogger
Network activity detected but not expressed in API logs

How to determine PWS:Win32/Lolyda!rfn?


File Info:
crc32: 2B335C7Fmd5: 705280473743f75ba4bbacccae92d77cname: zzzz.exesha1: 49241c71223735fc22c4e0db0e33fb19b42d9a2esha256: 7cd916530a031a562d2729bdfbbd60f509eb19fde00161b0c51c32451e6b3dd1sha512: 0d07cf970f99eef462c82e95605e1d50a3b90fde7834457d0389a77fb1c1bbf5601e20c8beaae1b3a4ae90ce46319f8454ba3bf0e7f2686a0499d6af855bb6f6ssdeep: 6144:JCSX1XdquMwamRoE0SWRP34Rmz3AaLJkgYr86cxKsjSU:wy1Xd8X134Rmz3ACkgYr86cvjtype: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9 NiceAssembly Version: 1.2.2.2InternalName: Nice.exeFileVersion: 1.2.2.2ProductName: NiceProductVersion: 1.2.2.2FileDescription: NiceOriginalFilename: Nice.exe

PWS:Win32/Lolyda!rfn also known as:

MicroWorld-eScan	Gen:Variant.Razy.252267
CAT-QuickHeal	TrojanSpy.Selltim.KC3
Qihoo-360	Win32/Trojan.97a
McAfee	GenericRXCK-DF!705280473743
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0055e3e01 )
BitDefender	Gen:Variant.Razy.252267
K7GW	Trojan ( 0055e3e01 )
Cybereason	malicious.73743f
Invincea	heuristic
F-Prot	W32/Trojan3.VKP
ESET-NOD32	MSIL/PSW.Agent.PGB
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Agent-1293761
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:MSIL/Generic.dba5c9e9
NANO-Antivirus	Trojan.Win32.Steam.eridlc
SUPERAntiSpyware	Trojan.Agent/Gen-Selltim
Rising	Stealer.Agent!8.C2 (CLOUD)
Ad-Aware	Gen:Variant.Razy.252267
Emsisoft	Gen:Variant.Razy.252267 (B)
Comodo	Malware@#2o5cldy5kab0t
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.PWS.Steam.3008
Zillya	Trojan.Agent.Win32.814093
TrendMicro	TROJ_GEN.R020C0PBB20
McAfee-GW-Edition	GenericRXCK-DF!705280473743
Fortinet	W32/Generic.PGB!tr
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.705280473743f75b
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.PSW
Cyren	W32/Trojan.OORB-8961
Webroot	W32.Selltim
MAX	malware (ai score=100)
Endgame	malicious (high confidence)
Arcabit	Trojan.Razy.D3D96B
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Lolyda!rfn
AhnLab-V3	Malware/Win32.Generic.C757326
VBA32	TrojanSpy.Selltim
ALYac	Trojan.Agent.231936B
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R020C0PBB20
Tencent	Win32.Trojan.Generic.Aenq
Yandex	Trojan.Agent!njczyWSIrqk
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_99%
GData	Gen:Variant.Razy.252267
BitDefenderTheta	Gen:NN.ZemsilF.34090.om0@am35f@ni
AVG	FileRepMetagen [Malware]
Avast	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.7164915.susgen