Trojan-PSW.PowerShell.Discoteka removal instruction

The Trojan-PSW.PowerShell.Discoteka is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-PSW.PowerShell.Discoteka virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Attempts to interact with an Alternate Data Stream (ADS)

How to determine Trojan-PSW.PowerShell.Discoteka?


File Info:
name: 789C9FA607F8A46FFA22.mlw
path: /opt/CAPEv2/storage/binaries/34e1bf62b89c7d55dd81a2ee3d8d9d73f1acd64daf8a902e5f6c347f7a46fccc
crc32: 0C3E15E1
md5: 789c9fa607f8a46ffa22084270709a49
sha1: 93029f86b74fb0fcc679bca3d38839ed5f08e88b
sha256: 34e1bf62b89c7d55dd81a2ee3d8d9d73f1acd64daf8a902e5f6c347f7a46fccc
sha512: b48e0da006774f13797b618dd2e56a7ba25c4fe5133435c5f2c37fa83d3ad6d7a37db7dd904772a5e80ae9ee24a9087037282a9ca0cfa912c76b6ae488f957dd
ssdeep: 1536:o2Y0VNblnigen1FQGpaika1PASjg/oWRvRm0VMf9X:o23rbZi/8GprF3jg/oQJhi
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T152A36B01B3A1CA76D59350721260977FC63DBA3436522503F368DCFA5E3A6929F1EE0E
sha3_384: 12f4228a803d631c4d6a61a104708d028cfa398811e955265bf53358561c3b212b99586e7927ddfc18390c134f71133d
ep_bytes: 558bec6aff683801410068f0b6400064
timestamp: 2023-04-18 22:40:23

Version Info:
0: [No Data]

Trojan-PSW.PowerShell.Discoteka also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Discoteka.4!c
McAfee	Artemis!789C9FA607F8
Alibaba	TrojanPSW:Win32/Discoteka.2e6be3bc
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-PSW.PowerShell.Discoteka.gen
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-QQPass.QQRob.Cdhl
F-Secure	Trojan.TR/Redcap.lsjnh
McAfee-GW-Edition	Artemis
Trapmine	malicious.high.ml.score
Ikarus	Trojan.Win32
GData	Win32.Trojan.Agent.9I3411
Jiangmin	Trojan.PSW.PowerShell.b
Avira	TR/Redcap.lsjnh
Antiy-AVL	Trojan/Win32.SGeneric
ZoneAlarm	HEUR:Trojan-PSW.PowerShell.Discoteka.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
Rising	Trojan.Generic@AI.100 (RDML:blxc7uDqn9e51N+kWKEyOw)
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen

How to remove Trojan-PSW.PowerShell.Discoteka?

Trojan-PSW.PowerShell.Discoteka removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X