Should I remove “Symmi.47923”?

The Symmi.47923 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Symmi.47923 virus can do?

• Executable code extraction
• Injection (inter-process)
• Compression (or decompression)
• Injection with CreateRemoteThread in a remote process
• Creates RWX memory
• Mimics the system’s user agent string for its own requests
• Reads data out of its own binary image
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Attempts to delete volume shadow copies
• Attempts to stop active services
• Modifies boot configuration settings
• Behavior consistent with a dropper attempting to download the next stage.
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a copy of itself
• Attempts to disable System Restore
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Symmi.47923?

File Info:
crc32: 6471DEB5
md5: 3411de1a6d1e8d8d10483cb98b442fdd
name: 3411DE1A6D1E8D8D10483CB98B442FDD.mlw
sha1: 1c5a33d302a0aa399720a3fc27a51fdf168cedf1
sha256: c759e9faa6d47baec903c47188feb26efc0d988ce06f344ded3dbdb1463970cc
sha512: 94881d6a39737aefdd5ee8e20e28baf128426521ab50644c231fcd41ce6e8f17e6e2860b9e40707cf13e93ee7aa691912201d6fc0f6bd3182f90706ff1f591ba
ssdeep: 6144:ziJy7vjebYhqtBgLO20KEXsOrOzJCjTw+VZRin:2MObYhq7gLKKEcR0jTzG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2014
InternalName: MnKeEJvsy
FileVersion: 1, 0, 0, 1
CompanyName: Ulead Systems, Inc.
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: Microsoft NYJngxHuX
SpecialBuild: 
ProductVersion: 1, 0, 0, 1
FileDescription: SJqDxWJ
OriginalFilename: hLfJJwRwi.exe
Translation: 0x0419 0x04b0

Symmi.47923 also known as:

How to remove Symmi.47923?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.