Trojan-PSW.Win32.Disco.feh removal tips

The Trojan-PSW.Win32.Disco.feh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-PSW.Win32.Disco.feh virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan-PSW.Win32.Disco.feh?


File Info:
name: 916BC8002AC44E37F602.mlw
path: /opt/CAPEv2/storage/binaries/189b317aa3992bce00d3e021b60b34211e96f7f6db5ff584956c01b2b753d903
crc32: 3BFFCB55
md5: 916bc8002ac44e37f602c79dcfe7910a
sha1: 6c8ce84c94a91fb2f4e22499cbfdbb0540d2be6f
sha256: 189b317aa3992bce00d3e021b60b34211e96f7f6db5ff584956c01b2b753d903
sha512: 223258eb63b4e1b205e40cc873080da5fb948291054d5185f40b9d73bb799e2b0a1ae3572d809add95365fa70dd8fa8a52fee2cc9fafa5066d10fa18fc22603a
ssdeep: 6144:+NyjCnqEct/l1JfpprZpTvUpTZhlFDmsaQNj1j:PVvJRprZ5cdLDXNj1j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C5244B1427B88A59F67E0BBED067000963F1A01B741EEB5DCE90B8DE3E1A7C1E50B567
sha3_384: f3ecdb46e966c0dc34b50942c503fae325f075e1c12e96aa366987b1cf41d8c6d73982f214d6b0d4ed27fd6eeadec780
ep_bytes: ff250020400001000000050000000600
timestamp: 2021-04-15 15:41:57

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: OsuBuddy
FileVersion: 1.0.0.0
InternalName: OsuBuddy.exe
LegalCopyright: Copyright ©  2021
LegalTrademarks: 
OriginalFilename: OsuBuddy.exe
ProductName: OsuBuddy
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan-PSW.Win32.Disco.feh also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Disco.tsl2
Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	RDN/Generic PWS.y
McAfee	RDN/Generic PWS.y
Cylance	unsafe
Zillya	Trojan.Disco.Win32.3293
Sangfor	Infostealer.Win32.Gamehack.Vy3l
K7AntiVirus	Unwanted-Program ( 00581e541 )
K7GW	Unwanted-Program ( 00581e541 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GameHack.BJI potentially unsafe
Cynet	Malicious (score: 100)
ClamAV	Win.Packed.Lazy-9956596-0
Kaspersky	Trojan-PSW.Win32.Disco.feh
SUPERAntiSpyware	Trojan.Agent/GenericKD
Avast	Win32:MalwareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13bff6e9
TrendMicro	TROJ_GEN.R002C0PAO24
Sophos	Generic Reputation PUA (PUA)
Jiangmin	Trojan.PSW.Disco.dcm
Varist	W32/ABRisk.CWMG-2247
Antiy-AVL	Trojan[PSW]/Win32.Disco
Microsoft	PUA:Win32/GameHack
ZoneAlarm	Trojan-PSW.Win32.Disco.feh
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C4702749
VBA32	TrojanPSW.Disco
MAX	malware (ai score=100)
Malwarebytes	GameHack.HackTool.RiskWare.DDS
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0PAO24
Rising	Malware.Obfus/MSIL@AI.85 (RDM.MSIL2:n0U4k6pk866fpLeNugys5Q)
Yandex	Riskware.Agent!Y71rTswt0zE
MaxSecure	Trojan.Malware.185715268.susgen
Fortinet	Riskware/GameHack
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan-PSW.Win32.Disco.feh?

Trojan-PSW.Win32.Disco.feh removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X