About “Trojan.Win32.Resetter.wbv” infection

The Trojan.Win32.Resetter.wbv is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Resetter.wbv virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Uses Windows utilities to enumerate running processes
• Authenticode signature is invalid
• Deletes executed files from disk
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Win32.Resetter.wbv?

File Info:
name: D5FDAA25EC9295B9084A.mlw
path: /opt/CAPEv2/storage/binaries/d2e303edec98a216c91d5871b62eca31badc6791986b7706382628a51be7a231
crc32: 7842BE5C
md5: d5fdaa25ec9295b9084aad2768703a37
sha1: 95c9c710012e07919283733a575600132cfc17f8
sha256: d2e303edec98a216c91d5871b62eca31badc6791986b7706382628a51be7a231
sha512: 7d15bec0b8e876874ca1d9ad12486bee5c5be29f2bc495d8bfb35ac472566cbe1804b25e6750ddb9772ef8e6b0c8c22e8a416c74e64acc62df854182a6e78763
ssdeep: 49152:wl8eO2awGd9sFU9RW3JvTN/EO0Xekp43Py/1xD4nBCgHFPXHp6rK2JDE:wZFGUUDsD/EO0Xnp4/QxDcCWSJDE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T127D533813FF96D8AD46D513895606A60DD37FC202A50C9041FE0BA4788F3673DDBBE9A
sha3_384: 226700b199d6c7fa6abaf31d92d62a8ef5fc9bdfdb8b1a7a8005a64437ecf372e117272244a52b7d9221dec953f20da5
ep_bytes: 558bec6aff687861400068cc30400064
timestamp: 2004-10-13 15:10:17

Version Info:
Comments: Created with Setup Factory 7.0
CompanyName: 
FileDescription: Setup Application
FileVersion: 7.0.1.0
InternalName: suf70_launch
LegalCopyright: Setup Engine Copyright © 2004 Indigo Rose Corporation
LegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFilename: suf70_launch.exe
PrivateBuild: 
ProductName: Setup Factory 7.0 Runtime
ProductVersion: 7.0.1.0
SpecialBuild: 
Translation: 0x0409 0x04e4

Trojan.Win32.Resetter.wbv also known as:

How to remove Trojan.Win32.Resetter.wbv?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.