Categories: Risk

Riskware.FlyStudio removal instruction

The Riskware.FlyStudio is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Riskware.FlyStudio virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Riskware.FlyStudio?


File Info:
name: 4B042091675BC6CED186.mlwpath: /opt/CAPEv2/storage/binaries/e607b34d5b5b0a5026283f4e33b5eca682cdc3fd4430266974c6bfaaccba2a04crc32: 328C74B6md5: 4b042091675bc6ced18604e48ea8a3e4sha1: c2e87846fb66c80231dac96ee910cc99095a47d7sha256: e607b34d5b5b0a5026283f4e33b5eca682cdc3fd4430266974c6bfaaccba2a04sha512: 7dc840c0bbabcef507e19deef539ff40d0b45560c73ee7d6fdd9cb7e5b59c5800db4568287ee387415eefa4c1201be7cf884b0df469b4e7ef92b697fc9c820a6ssdeep: 6144:kR9pL6jKHQsqqSHztx+QsqVD93Twuf+sJKm4rgc6dDb1VQ6aGgWqR+8du6k0t0u:kFoKuqShcXqVD9Dz+he1VQ6TgRu6ktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10FE49C11BDF290F2CA1A15F2086E7736A631EB054B15CFC36395EE2C2D3AE8195371B6sha3_384: 1baf73f28af4071845845e782d241ec728af2550c335ce3f7bf940c68f1808c7c2458e1fa21d7bf8a82ecc3bf170196cep_bytes: 558bec6aff6890a24700688c20450064timestamp: 2010-03-19 06:14:53
Version Info:
FileVersion: 1.2.0.0FileDescription: 去除万象的广告及插件和多余进程。ProductName: 万象去广告外挂ProductVersion: 1.2.0.0CompanyName: IT网管联盟（www.itwglm.net）LegalCopyright: IT网管联盟（www.itwglm.net）Comments: 程序：再生缘
ＱＱ：37370622Translation: 0x0804 0x04b0

Riskware.FlyStudio also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Multi.Generic.mvp9
FireEye	Generic.mg.4b042091675bc6ce
CAT-QuickHeal	Trojanpws.Qqpass.16554
McAfee	PolyPatch-UPX
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005246d51 )
Alibaba	Trojan:Win32/PolyPatch.0879e0e0
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.6fb66c
Cyren	W32/Trojan.CLL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Cynet	Malicious (score: 100)
Avast	Win32:dUmPeX [Susp]
F-Secure	Trojan.TR/Patched.Gen
DrWeb	Trojan.Click3.31045
TrendMicro	TROJ_GEN.R014C0PG723
McAfee-GW-Edition	BehavesLike.Win32.MultiDropper.bm
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.BKGLI3
Jiangmin	Trojan.Generic.atvvj
Avira	TR/Patched.Gen
Antiy-AVL	Trojan/Win32.FlyStudio.a
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Microsoft	Trojan:Win32/Wacatac.A!ml
Google	Detected
VBA32	Riskware.FlyStudio
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R014C0PG723
Rising	Trojan.Win32.Generic.167A3B1D (C64:YzY0OkZpl8F+iyak)
Yandex	Trojan.Pasta.Gen.1
Ikarus	Trojan.Danglo
Fortinet	Riskware/FlyStudio
AVG	Win32:dUmPeX [Susp]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)