Malware

PWS:Win32/Vidar.YB!MTB information

Malware Removal

The PWS:Win32/Vidar.YB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PWS:Win32/Vidar.YB!MTB virus can do?

  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Uses Windows utilities for basic functionality
  • Steals private information from local Internet browsers
  • Collects information about installed applications
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients
  • Harvests information related to installed mail clients
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

Related domains:

xakfor.net
survey-smiles.com
ip-api.com

How to determine PWS:Win32/Vidar.YB!MTB?


File Info:

crc32: AA0950B3
md5: ed1e5792000d46ce259f1921f014967d
name: ED1E5792000D46CE259F1921F014967D.mlw
sha1: 9e4d2aa15d2d6c61e3bebb0b5bd4d4c4d3f663fd
sha256: 600552e69cace5f3ae996afd8c3376bd2bdd2d486e1fa7187587e197f25a86fa
sha512: c7a171a180960e993e752918a65687fe4f89edec7a4588cb670311c14682a62a017f37419de7ce2e7d4ef0b0dbe10b24c0f827ab9bd97d2714cec11e7bbc102b
ssdeep: 12288:DBaxwL7Yke3dHZmXJfMkz2zAJu+fpdHOyrSrvWlX3/m:Faa3reN5mXPKzAo0pkyrSrvWlO
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

PWS:Win32/Vidar.YB!MTB also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Stealer.25468
MicroWorld-eScanGeneric.SpyAgent.6.63D5A0A0
FireEyeGeneric.mg.ed1e5792000d46ce
McAfeeGenericRXHD-PT!ED1E5792000D
MalwarebytesSpyware.Vidar
VIPRETrojan.Win32.Generic!BT
SangforVirus_Suspicious.Win32.Sality.ae
K7AntiVirusPassword-Stealer ( 0053c3ab1 )
BitDefenderGeneric.SpyAgent.6.63D5A0A0
K7GWPassword-Stealer ( 0053c3ab1 )
Cybereasonmalicious.2000d4
BitDefenderThetaGen:NN.ZexaF.34590.ImW@aGiM@i
CyrenW32/Vidar.A.gen!Eldorado
SymantecInfostealer.Vidar
APEXMalicious
AvastWin32:PWSX-gen [Trj]
ClamAVWin.Malware.Razy-6795329-0
KasperskyHEUR:Trojan.Win32.Generic
AlibabaTrojanPSW:Win32/Vidar.5b4d44f7
NANO-AntivirusTrojan.Win32.Stealer.fmiqzg
AegisLabTrojan.Win32.Generic.4!c
TencentMalware.Win32.Gencirc.10b9a933
Ad-AwareGeneric.SpyAgent.6.63D5A0A0
SophosMal/Generic-S
ComodoMalware@#1129dsez9ykmt
F-SecureTrojan.TR/AD.VidarStealer.awl
ZillyaTrojan.Agent.Win32.1325331
McAfee-GW-EditionBehavesLike.Win32.Generic.hh
EmsisoftTrojan-PSW.Tepfer (A)
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.PSW.Tepfer.jbr
eGambitUnsafe.AI_Score_99%
AviraTR/AD.VidarStealer.awl
MAXmalware (ai score=100)
Antiy-AVLTrojan[PSW]/Win32.Tepfer
MicrosoftPWS:Win32/Vidar.YB!MTB
ArcabitGeneric.SpyAgent.6.63D5A0A0
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataGeneric.SpyAgent.6.63D5A0A0
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.R296259
VBA32Trojan.Encoder
ALYacTrojan.Downloader.568320A
CylanceUnsafe
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/PSW.Agent.OGR
RisingStealer.Vidar!1.B80D (CLOUD)
YandexTrojan.GenAsa!9EVEKkASkXQ
IkarusTrojan-Spy.Vidar
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/GenKryptik.DDSI!tr.pws
AVGWin32:PWSX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_70% (D)
Qihoo-360HEUR/QVM10.2.BFBF.Malware.Gen

How to remove PWS:Win32/Vidar.YB!MTB?

PWS:Win32/Vidar.YB!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment