Symmi.87929 (B) removal guide

The Symmi.87929 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Symmi.87929 (B) virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Attempts to connect to a dead IP:Port (2 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Creates a copy of itself
Attempts to create or modify system certificates
Anomalous binary characteristics

Related domains:

cdn.discordapp.com

xchilogs.duckdns.org

xxxxza.dynamic-dns.net

How to determine Symmi.87929 (B)?


File Info:
crc32: F8C0C284
md5: ba3c4701ed3bd5a341ec2a9799533597
name: BA3C4701ED3BD5A341EC2A9799533597.mlw
sha1: 57e44076be0f1a4ad2edf9afbce8a9c5b31d6ea9
sha256: d7be78128d33fcdc14330c397050b6d18a1539e1e39cbb9be1e2aac53f9e6ba5
sha512: c2310a294cd1e529d786654b41b49b4b13a1af9571d115248a815823e550a33d819334a3484f2cbbc3c2cb291dfef52be62ba362d155bb7e51c04507ba9f200f
ssdeep: 12288:TZ3el3KnPgOu9G5Kpzs0R/d0I8ZdGlksmU793gwn:TBKYNEzzWVqlkTU793gwn
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 2015 Avira Operations GmbH & Co. KG and its Licensors
Assembly Version: 2.37.1.24463
InternalName: Avira.WebAppHost.exe
FileVersion: 2.37.1.24463
CompanyName: Avira Operations GmbH & Co. KG
LegalTrademarks: 
Comments: 
ProductName: Avira Phantom VPN
ProductVersion: 2.37.1.24463
FileDescription: Avira Phantom VPN
OriginalFilename: Avira.WebAppHost.exe

Symmi.87929 (B) also known as:

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Gen:Variant.Symmi.87929
FireEye	Generic.mg.ba3c4701ed3bd5a3
McAfee	Artemis!BA3C4701ED3B
Malwarebytes	Trojan.MalPack.SMY.Generic
BitDefender	Gen:Variant.Symmi.87929
Cybereason	malicious.1ed3bd
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
Alibaba	Trojan:Win32/Generic.75253e52
Rising	Downloader.Delf!8.16F (TFE:4:IlrR6cQKndO)
Ad-Aware	Gen:Variant.Symmi.87929
F-Secure	Trojan.TR/Dldr.Delf.npjii
DrWeb	Trojan.Siggen11.60342
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Symmi.87929 (B)
Ikarus	Trojan.Inject
Avira	TR/Dldr.Delf.npjii
MAX	malware (ai score=88)
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Woreflint.A!cl
Arcabit	Trojan.Symmi.D15779
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
GData	Gen:Variant.Symmi.87929
Cynet	Malicious (score: 85)
BitDefenderTheta	Gen:NN.ZelphiCO.34780.YG1@ai6vjVbi
ALYac	Gen:Variant.Symmi.87929
ESET-NOD32	a variant of Win32/TrojanDownloader.Delf.DDQ
Tencent	Win32.Trojan.Falsesign.Pfjg
SentinelOne	Static AI – Suspicious PE
eGambit	PE.Heur.InvalidSig
Fortinet	W32/GenKryptik.EKLE!tr
AVG	Win32:Malware-gen
Qihoo-360	Win32/Backdoor.Androm.HgIASOEA

How to remove Symmi.87929 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Symmi.87929 (B) removal guide