Should I remove “PWS:Win32/Sinowal!AA”?

The PWS:Win32/Sinowal!AA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Sinowal!AA virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Attempted to write directly to a physical drive

How to determine PWS:Win32/Sinowal!AA?

File Info:
name: DB454B64446B23B6AD2E.mlw
path: /opt/CAPEv2/storage/binaries/49ded6bdac4728c6bb4dda1cfc6098830cd1ec48a86ab42bc1f6b74bf61e700a
crc32: DB642B9C
md5: db454b64446b23b6ad2ea8f9743cdff1
sha1: de912bfde19da7629e84c4ccbeab922406a518ab
sha256: 49ded6bdac4728c6bb4dda1cfc6098830cd1ec48a86ab42bc1f6b74bf61e700a
sha512: abc26e73bd7a7390d549d4194bd6a910cc95132c150b977546593eaea67b62ae0a393406cc13e5531bf3a16b6d2c94dce9729feb51db0d0f34181d3e1950cb47
ssdeep: 768:TtFDsLzYFSLxK/864vPuFUJPJIFqYF+SPA8ckVxBm85ih+2:PoLSSLAn4XuFUPoqYFq8/xBb552
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T19B432A1F599EF8F3E0BA15B6DC0BB45A94745676D1006CC3E7622E398220CD34E2BE4E
sha3_384: b9aa130646f964bfa152c3dc6db03aa7a00cbc75c593ff9183ce3dbd1cc9042367b49b58c24955d04b753e67e430c27b
ep_bytes: 833dc4f40010007529e8a65e0000e8fa
timestamp: 2002-03-20 11:39:41

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows NT Setup Executable
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
InternalName: SETUP.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: SETUP.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.5512
Translation: 0x0409 0x04b0

PWS:Win32/Sinowal!AA also known as:

How to remove PWS:Win32/Sinowal!AA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.