Trojan-Spy.Win32.SpyEyes.dxt removal

The Trojan-Spy.Win32.SpyEyes.dxt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.SpyEyes.dxt virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Attempts to modify desktop wallpaper
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Behavioural detection: Transacted Hollowing
• Creates a hidden or system file
• Creates a copy of itself

How to determine Trojan-Spy.Win32.SpyEyes.dxt?

File Info:
name: C502D6D88A7C03B47BF2.mlw
path: /opt/CAPEv2/storage/binaries/4c3767109188408afa74d6c424e967fecfa9ad016313cee3b35481b9cb931001
crc32: E7FF4EB1
md5: c502d6d88a7c03b47bf2cd03e36d9f72
sha1: 94b4eb61f59268100dfa94b0483064afd08e4993
sha256: 4c3767109188408afa74d6c424e967fecfa9ad016313cee3b35481b9cb931001
sha512: b387cfaf36a94bef4c45631ffc6621688508cff63878fb81b53daf043877aa2dcfff1b3e70c2605ede23fafb91d4b8278e5bdf94ebd475e0650626911dfc405c
ssdeep: 6144:LjOP0UuHWbzMnLxPbajqmKeO5fzTAWYpL3OOgcC2TToSYcBO:mcrWbstiEeO5bTvcLkDGToSYc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18544124DA989CA7AF9DC263159FA42902934BC19CCB20ACD26D5B31FD433B11DE8C97D
sha3_384: a4ae1335429b16b7a8e72ae3a0a4019c745b645f9975aa38c8bf02ca53cda42e7ee89219a8a837a8b42e8120e6dd12be
ep_bytes: 60be000043008dbe0010fdff5789e58d
timestamp: 2007-11-05 03:39:03

Version Info:
Comments: 
CompanyName: Avira GmbH
FileDescription: Antivirus Control Center
FileVersion: 8.00.70.08
InternalName: Control Center
LegalCopyright: Copyright © 2008 Avira GmbH. All rights reserved.
LegalTrademarks: AntiVir® is a registered trademark of Avira GmbH, Germany.
OriginalFilename: avcenter.exe
PrivateBuild: 
ProductName: AntiVir Workstation
ProductVersion: 8.00.70.08
SpecialBuild: 
Translation: 0x0800 0x04b0

Trojan-Spy.Win32.SpyEyes.dxt also known as:

How to remove Trojan-Spy.Win32.SpyEyes.dxt?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.