What is “Trojan.MSIL.Disfa.bqba”?

The Trojan.MSIL.Disfa.bqba is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.MSIL.Disfa.bqba virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Trojan.MSIL.Disfa.bqba?

File Info:
name: 71A61629CD367A68BEF5.mlw
path: /opt/CAPEv2/storage/binaries/8f8883e42775c2e31829d06c98c7729ed2516f9f1a44e920046842f6fa409602
crc32: 50368967
md5: 71a61629cd367a68bef59717ee51af89
sha1: 016d69a0a701907250d3df33dd57e4f8a78c778e
sha256: 8f8883e42775c2e31829d06c98c7729ed2516f9f1a44e920046842f6fa409602
sha512: e93302bd0d6c12709c78280fecf6b3b9a355b505e9da192eadb3df767ad5cf0106904cb4aec1a15d2125afe50efe5f75efd4ccb749c84a955c88a28d4dffecb2
ssdeep: 12288:sdeVQkTrvj4ftjyi8COBnlRL/ASMD1hWDFY8iyt4/N:s0QkTf4VyiOxDWZhWRF2/N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17DD4121478C0C273E5BA143194E5CBB9DA7638361B6B51D3B78A6FB62E223E057312C9
sha3_384: c01352a6841c639fa4cc2dcaed726a504fc989cf6416f2ec4004072ec6bb01d1f9a517727aff61679946abc71ea7e0b8
ep_bytes: e8125b0000e9a4feffff6a0c68381142
timestamp: 2013-08-10 07:55:45

Version Info:
Translation: 0x0000 0x04b0
Comments: RPX 1.3.4400.61



FileDescription:  
FileVersion: 0.0.0.0
InternalName: Server333.exe
LegalCopyright:  
OriginalFilename: Server333.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Trojan.MSIL.Disfa.bqba also known as:

How to remove Trojan.MSIL.Disfa.bqba?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.