How to remove “Trojan-Downloader.Win32.Upatre.ecdm”?

The Trojan-Downloader.Win32.Upatre.ecdm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Downloader.Win32.Upatre.ecdm virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Polish
• Unconventionial language used in binary resources: Polish
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavior consistent with a dropper attempting to download the next stage.
• Attempts to modify proxy settings
• Mimics icon used for popular non-executable file format
• Anomalous binary characteristics

How to determine Trojan-Downloader.Win32.Upatre.ecdm?

File Info:
name: 2BDA6C0B5D3EFBE63CBE.mlw
path: /opt/CAPEv2/storage/binaries/e3e32d4110884b2a10f2d2272f13a97b4ddb4e83d73a149a191c7ce872a44c9a
crc32: 06D86A3B
md5: 2bda6c0b5d3efbe63cbe1912090fb5d9
sha1: f4111e58028ce6d2875ee37be96107b0a0db9d6c
sha256: e3e32d4110884b2a10f2d2272f13a97b4ddb4e83d73a149a191c7ce872a44c9a
sha512: 729025dddbe026d82a5033531514592d972c71fa5f975d4d741ed9515564434d250303f8922a00c841aeaf7f3e76438805605c83cd7b1cf80e1c70c1bd314764
ssdeep: 768:s+pWrOOfbMUI4ybFrcUtxLKxouHd5slovvlLuzTV:s+pWrvI+UFrjxWxo45slovteB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12713E5B266D85141E6A14F3DC1B266C512AABE217EF5F84FCC8472C55F336C2B9F0A12
sha3_384: c34aefeba51b54b87897c9d4b89f3b00ac18ca931988e647fcff0cf61a3716cb2ee0d9fc38edbb03cecda73b3540a9cb
ep_bytes: 558bec83ec44a1446a400085c0740aff
timestamp: 2014-02-09 09:13:53

Version Info:
CompanyName: Winapp
FileDescription: Winapp
FileVersion: 1.1.2.17
InternalName: WinappInternal
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
ProductName: Winapp
ProductVersion: 2.17
Translation: 0x0415 0x04e4

Trojan-Downloader.Win32.Upatre.ecdm also known as:

How to remove Trojan-Downloader.Win32.Upatre.ecdm?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.