Ser.MSILPerseus.759 removal instruction

The Ser.MSILPerseus.759 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ser.MSILPerseus.759 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• .NET file is packed/obfuscated with SmartAssembly
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Attempts to remove evidence of file being downloaded from the Internet
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Harvests credentials from local FTP client softwares
• Harvests information related to installed instant messenger clients
• Harvests information related to installed mail clients

How to determine Ser.MSILPerseus.759?

File Info:
name: 0B08EA3B83370CDF4F59.mlw
path: /opt/CAPEv2/storage/binaries/d2ae849cda3a8ef809f96c84f72735ede7c9da7e009a26c6418b7f7a0b51668c
crc32: 61A6D1DE
md5: 0b08ea3b83370cdf4f59b2542c4f7677
sha1: e1d38f73997e51660d76ac4cc636b1f0b76e9b0f
sha256: d2ae849cda3a8ef809f96c84f72735ede7c9da7e009a26c6418b7f7a0b51668c
sha512: 755e35f722fcf5d030228f55aadb77a63a2818bfff00cc62f4fc3a7fb1db371fb41523810115384737e704f0339c2aff05b327a532c6b8ac1ea24dc10bd41426
ssdeep: 12288:4qjjbtzEgDMEH3LpCrX9Jo67QF+uHl7eyZ6o6pAoAy:4Cj1fWXHo67QHlVZ0A5y
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T185A4F2A2254BC45CC56D463224DAB6C0FA76377A3F60CA2E719D072D7E3255EEB0132B
sha3_384: ddda46c162fb4958a3417369a1194bb4455177890800b50e4c5bab264ded77c4444259c85ff16999687ef54ae899e3c8
ep_bytes: ff250020400000000000000000000000
timestamp: 2016-05-02 02:13:39

Version Info:
Comments: 
CompanyName: 
FileDescription:  Device Association Service
FileVersion: 1.0.0.0
InternalName: letal.exe
LegalCopyright: Copyright ©  2016
LegalTrademarks: 
OriginalFilename: letal.exe
ProductName:  DeviceAsssociationService 
ProductVersion: 1.0.0.0
Assembly Version: 52.121.1.1
Translation: 0x0000 0x04b0

Ser.MSILPerseus.759 also known as:

How to remove Ser.MSILPerseus.759?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.