PWS:Win32/Racoon.AD!MTB removal instruction

The PWS:Win32/Racoon.AD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Racoon.AD!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• CAPE detected the Raccoon malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Detects VirtualBox through the presence of a device
• Collects information to fingerprint the system

How to determine PWS:Win32/Racoon.AD!MTB?

File Info:
name: 73155D112A67A98CAA29.mlw
path: /opt/CAPEv2/storage/binaries/0be25e0f70f4ee306ff450a3701065c46db7652114bf5ad0109f7c5ec3bac8d7
crc32: 5F094A19
md5: 73155d112a67a98caa29627a896b1f35
sha1: e36f38303e81c5b7bab9f9a14a99a61b27abbb3e
sha256: 0be25e0f70f4ee306ff450a3701065c46db7652114bf5ad0109f7c5ec3bac8d7
sha512: e4d074901aae6ae361e5dbd0ce6ec7f5623f41d0dee36addda4fb953e2f4d2b5fc117fef3cb2291010571bb7a7c4f44185cf25fc64d8bb515ac319bd43c3b69e
ssdeep: 24576:bB5/E0vk/u79Mb5Edft7jO7hERSfSP3koteKb3ozPrHaJ4lcXJJqDRvd:D9vEuxKUt7R+SPUov0jacAJqDdd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A665230BAB881475D8175232AB62C57D01E4ACE79C74CF463DD5784EE8F3292412BF6B
sha3_384: 0321333b7e510ef75bc7d5b25279b0912fb6ee904d24fd41ee2ce909abc8f5862d678f88ff0e241bf37dc0911f1ed631
ep_bytes: eb05f1f09d2b7f50eb01ebe812000000
timestamp: 2022-01-19 10:29:28

Version Info:
CompanyName: AnyDesk Software GmbH
FileDescription: AnyDesk
FileVersion: 7.0.4
ProductName: AnyDesk
ProductVersion: 7.0
LegalCopyright: (C) 2021 AnyDesk Software GmbH
Translation: 0x0409 0x04e4

PWS:Win32/Racoon.AD!MTB also known as:

How to remove PWS:Win32/Racoon.AD!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.