Symmi.21621 removal guide

The Symmi.21621 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Symmi.21621 virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Symmi.21621?


File Info:
name: F4B65798B2B95E90D46E.mlw
path: /opt/CAPEv2/storage/binaries/f2f4c4c818bd905aff90d1f04ed15289289030bb3ca401e3e0fd7ea44def5ae2
crc32: AC2A41CF
md5: f4b65798b2b95e90d46eb131c34f6833
sha1: d0483acee551a80c01d4571eb86c581fa5228692
sha256: f2f4c4c818bd905aff90d1f04ed15289289030bb3ca401e3e0fd7ea44def5ae2
sha512: f896b675dd67e0c635baa027d1122198242665638b0a67438ce8452b6e6471c5b5f8caea5dd541013c6cc46e3a2d744102d4394c4eedd9cd878d0b27d6e0b2d5
ssdeep: 768:IGtQh/j1K53Kf0X2y3xwvXbNlsV8CjTGqR7pRWXhCpk77y5nHMtJ9PwEB4j8nniP:ImQdY539R3sLNlwG0uRFyBMtTP9nnitp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19A23F100E5F891BAF0F727B064F9030A586EBC4173B59B090774584F2EB286DED28772
sha3_384: bf5339f495006a7767b152d08bd133b9966d1fb095247b046f31e692aee1e356e55e8afa12e9fbddb6dacbecbe0d6fe1
ep_bytes: 60be00d040008dbe0040ffff5783cdff
timestamp: 2009-07-08 19:43:24

Version Info:
Comments: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName: Apache Software Foundation
FileDescription: ApacheBench command line utility
FileVersion: 2.2.14
InternalName: ab.exe
LegalCopyright: Copyright 2009 The Apache Software Foundation.
OriginalFilename: ab.exe
ProductName: Apache HTTP Server
ProductVersion: 2.2.14
Translation: 0x0409 0x04b0

Symmi.21621 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Jorik.lrUS
MicroWorld-eScan	Gen:Variant.Symmi.21621
ClamAV	Win.Trojan.Swrort-5710536-0
FireEye	Generic.mg.f4b65798b2b95e90
CAT-QuickHeal	Trojan.Swrort.A
ALYac	Gen:Variant.Symmi.21621
Cylance	unsafe
VIPRE	Gen:Variant.Symmi.21621
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0058f5f51 )
Alibaba	Trojan:Win32/CobaltStrike.5c89
K7GW	Trojan ( 0058f5f51 )
Cyren	W32/Swrort.D
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Rozena.ADH
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Symmi.21621
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Evo-gen [Trj]
Emsisoft	Gen:Variant.Symmi.21621 (B)
F-Secure	Trojan.TR/Patched.Gen2
Zillya	Trojan.RozenaGen.Win32.2
TrendMicro	Backdoor.Win32.SWRORT.SMAL01
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Exploit.PDF
GData	Gen:Variant.Symmi.21621
Webroot	W32.Trojan.Swrort.Gen
Avira	TR/Patched.Gen2
Antiy-AVL	Trojan/Win32.Rozena
Kingsoft	malware.kb.b.933
Xcitium	TrojWare.Win32.Rozena.A@4jwdqr
Arcabit	Trojan.Symmi.D5475
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Backdoor/Win32.Bifrose.R12476
McAfee	GenericRXAA-AA!F4B65798B2B9
MAX	malware (ai score=89)
VBA32	Trojan.Swrort
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Backdoor.Win32.SWRORT.SMAL01
Rising	Trojan.Crypto!8.364 (TFE:5:qRUE1u5wYD)
Yandex	Trojan.GenAsa!O0/tdGI4TGA
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Rozena.ABV!tr
BitDefenderTheta	Gen:NN.ZexaF.36738.cmKfayh5cNdi
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Symmi.21621?

Symmi.21621 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X