Categories: Malware

How to remove “PWS:Win32/QQThief.J”?

The PWS:Win32/QQThief.J is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/QQThief.J virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Uses Windows utilities for basic functionality
Reads data out of its own binary image
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Deletes executed files from disk
Anomalous binary characteristics

How to determine PWS:Win32/QQThief.J?


File Info:
name: 716A52B69C2B7794DD6F.mlwpath: /opt/CAPEv2/storage/binaries/db339c4c9de6853beb5fc47126dd8da46ca1c3acbf20cd05b45be74018460113crc32: 6891CAA6md5: 716a52b69c2b7794dd6fcb5869876b2fsha1: 96f132da9843d5e3db889c8d9fe1d4bd4b43ce66sha256: db339c4c9de6853beb5fc47126dd8da46ca1c3acbf20cd05b45be74018460113sha512: 659ecf1230697e8d2b6ce5a55e4ec3ee6f5204675f3d52bae64f1281265bfeeca45fed73cf4177add0af4ba886a778eaf324e94a4d5bc7b230293bd431ed4b67ssdeep: 6144:1d3JFLU+EdcBy48tRjzcoVnPxulC/qxtvAOhLVCA:XjLhEKy48tG4n5VGtvA+LVCAtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19F342306DFB84602FB8AA8350D2D523B6650B90DC13CBE1EF3826CA96E275DCD57274Dsha3_384: d2b5f34e4adc4ffad0ebb3d7ae34c9c44c61245e54466ea3993e159a964ff76f19a4769f7f4c7ecc1e460882062c986fep_bytes: 558bec6aff6848314000680026400064timestamp: 2011-05-26 03:49:54
Version Info:
Comments: CompanyName: Microsoft CorporationFileDescription: Mircorsoft Update Server PacketFileVersion: 1, 0, 0, 1InternalName: MsUpdateLegalCopyright: (C) Microsoft Corporation. All rights reserved.LegalTrademarks: OriginalFilename: MsUpdatePrivateBuild: ProductName: Mircorsoft Update Server PacketProductVersion: 1, 0, 0, 1SpecialBuild: Translation: 0x0409 0x04b0

PWS:Win32/QQThief.J also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Zusy.431427
FireEye	Generic.mg.716a52b69c2b7794
Skyhigh	Generic PWS.nr
McAfee	Generic PWS.nr
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Zusy.431427
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 0040f4861 )
K7AntiVirus	Trojan ( 0040f4861 )
Baidu	Win32.Trojan.Agent.akn
VirIT	Trojan.Win32.Gamania.BYLD
Symantec	Infostealer.QQLogger
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Agent.NVN
APEX	Malicious
ClamAV	Win.Malware.Qqlogger-6733119-0
Kaspersky	Trojan-Spy.Win32.QQLogger.vnn
BitDefender	Gen:Variant.Zusy.431427
NANO-Antivirus	Trojan.Win32.Gamania.tfgae
SUPERAntiSpyware	Trojan.Agent/Gen-Faldesc[Cont]
Avast	Win32:Evo-gen [Trj]
Sophos	Mal/BadCert-Gen
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.PWS.Gamania.34089
Zillya	Trojan.QQLogger.Win32.162
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Zusy.431427 (B)
SentinelOne	Static AI – Suspicious PE
MAX	malware (ai score=88)
GData	Gen:Variant.Zusy.431427
Jiangmin	TrojanSpy.QQLogger.lx
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Dropper.Gen
Varist	W32/QQpass.R.gen!Eldorado
Kingsoft	malware.kb.a.999
Xcitium	TrojWare.Win32.Spy.Agent.NXQA@82k5nl
Arcabit	Trojan.Zusy.D69543
ZoneAlarm	Trojan-Spy.Win32.QQLogger.vnn
Microsoft	PWS:Win32/QQThief.J
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win32.QQLogger.R15095
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36744.oq1@aGFb6Gkb
ALYac	Gen:Variant.Zusy.431427
TACHYON	Trojan-Spy/W32.QQLogger.237968
VBA32	BScope.TrojanPSW.Hooker
Cylance	unsafe
Panda	Trj/Genetic.gen
Rising	Stealer.QQPass!1.9D52 (CLASSIC)
Ikarus	Trojan-PWS.Win32.QQthief
Fortinet	W32/Agent.NXS!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.a9843d
DeepInstinct	MALICIOUS