About “Trojan.Win32.Ekstak.ivhq” infection

The Trojan.Win32.Ekstak.ivhq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.ivhq virus can do?

• Executable code extraction
• Attempts to connect to a dead IP:Port (1 unique times)
• Creates RWX memory
• HTTP traffic contains suspicious features which may be indicative of malware related traffic
• Performs some HTTP requests
• The binary likely contains encrypted or compressed data.
• Queries information on disks, possibly for anti-virtualization
• Detects the presence of Wine emulator via registry key
• Checks the version of Bios, possibly for anti-virtualization
• Attempts to modify proxy settings
• Collects information to fingerprint the system
• Anomalous binary characteristics

Related domains:

How to determine Trojan.Win32.Ekstak.ivhq?

File Info:
crc32: AA267E4F
md5: 1da8071020278c45b1b528f2c6240bab
name: 1DA8071020278C45B1B528F2C6240BAB.mlw
sha1: 4fd4020c0b8ba0f872202b4d537e97abb3417800
sha256: 033689511c2878be2deb87c97dd10f95c31e8fb410020d6ac48a3c963f0f5da0
sha512: 07470783a5df50238ecb1093f14e1ef622a20e726d662396f01d474fbd17366e4d14aa27aebacc9595dafb1d939e449ab7d21d7e5cd7142ff4f5da82e984cebf
ssdeep: 12288:br1rc0MWM7jPB0nw/Q0GGaKW/HosVU5v6jESmoibf4uI2jVw7qjmx7Xu0spP:CXZ/Q0GGiHNZNx4NI4Wqjm7XulpP
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: BHRepair.exe
FileVersion: 3.2.1109.53
Comments: Framework 3.40 installer
ProductName: Framework 3.40 Setup
ProductVersion: 3.2.1109.53
FileDescription: Framework 3.40 Setup
OriginalFilename: BHRepair.exe
Translation: 0x0409 0x04b0

Trojan.Win32.Ekstak.ivhq also known as:

How to remove Trojan.Win32.Ekstak.ivhq?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.