Should I remove “Troj/MewsSpy-A”?

The Troj/MewsSpy-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/MewsSpy-A virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Sample contains Overlay data
• Checks adapter addresses which can be used to detect virtual network interfaces
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid
• Created a process from a suspicious location
• A process sent information about the computer to a remote location.
• Attempts to identify installed AV products by installation directory
• Attempts to detect ThreatTrack/GFI/CW Sandbox through the presence of a file
• Attempts to modify proxy settings
• Deletes executed files from disk

How to determine Troj/MewsSpy-A?

File Info:
name: E89E7CDD765C8BC9376E.mlw
path: /opt/CAPEv2/storage/binaries/ce26973e1469e8cc58c25d4dbf1c1824476ebce4af8022fec33d8c5bf905f784
crc32: 9617A24C
md5: e89e7cdd765c8bc9376eb36ba520b84d
sha1: f61834211fab76d0f31a563e14b7a47ebf5eb42b
sha256: ce26973e1469e8cc58c25d4dbf1c1824476ebce4af8022fec33d8c5bf905f784
sha512: 59399b94feeccae2102a056eff8a1456336ee8fadf6f94b384597cea745b3499419144eab1b88c4ef2e4eb7ca67ce444db9c1dc68efddbf9f29c024a1968e0d4
ssdeep: 6144:W2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrK8/PzDvc2Eyv:W2TFafJiHCWBWPMjVWrjM2/v
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11E948D5276C08032C46E1574D4BBAB7349397E355B31A6C3B3D07E69BDB12D2AA3834E
sha3_384: bf41dc4ea58cd17927a1eec42696b6e77ed7913c2d05349f0075efa7e265f6e9820408fe875f10a08958a53eb9a5f3f1
ep_bytes: e8bf9e0000e989feffffff3520484400
timestamp: 2013-10-31 11:53:49

Version Info:
0: [No Data]

Troj/MewsSpy-A also known as:

How to remove Troj/MewsSpy-A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.