Categories: Trojan

How to remove “Trojan.Win32.Wecod.all”?

The Trojan.Win32.Wecod.all is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Wecod.all virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Korean
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Trojan.Win32.Wecod.all?


File Info:
name: 3064C2D648E5F4403F97.mlwpath: /opt/CAPEv2/storage/binaries/622eb88a692dfb1157ca8c909af49abded9e8ec591be379d0f926570fd8c3603crc32: CE299BADmd5: 3064c2d648e5f4403f97e8213a3fb70csha1: bff2cd699214827892e7305ba0e529d334dffde6sha256: 622eb88a692dfb1157ca8c909af49abded9e8ec591be379d0f926570fd8c3603sha512: dc74f7ad150dc269aa32ce4e3474c9c09973e52c32209fc00f85bff8cdfbb6983750452e857315f4db88eeec23adedadf54153874f60246b997460591f024345ssdeep: 3072:jBcyGvCKY6PYTZeAgYjPWrtfb5outzQIN3C9ISE0qJiNlUtcW4UV:7s+SYPPWrnoSzQISzqJBcGtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10424DF52A6008898F71D0B725907F6E408998E7D68D4F15FF43CBE36A8722971EB724Fsha3_384: 42a02149a062e09ade674883dd853bf4329eb4497b8a437e9bd696f0f9160250b0c183672fc65a027851973bb29e6f55ep_bytes: 60be003048008dbe00e0f7ff5789e58dtimestamp: 2013-09-08 04:52:30
Version Info:
0: [No Data]

Trojan.Win32.Wecod.all also known as:

tehtris	Generic.Malware
DrWeb	Trojan.AVKill.63827
MicroWorld-eScan	Gen:Heur.Mint.SP.Urelas.1
FireEye	Generic.mg.3064c2d648e5f440
CAT-QuickHeal	Trojan.Urelas.B6
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 00588d7d1 )
K7GW	Spyware ( 00588d7d1 )
Cybereason	malicious.648e5f
Arcabit	Trojan.Mint.SP.Urelas.1
BitDefenderTheta	Gen:NN.ZexaF.34712.nmHfa0S!RsiO
VirIT	Trojan.Win32.Generic.CONR
Cyren	W32/CardSpy.I.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.CardSpy.NAF
Zoner	Probably Heur.ExeHeaderL
APEX	Malicious
Kaspersky	Trojan.Win32.Wecod.all
BitDefender	Gen:Heur.Mint.SP.Urelas.1
NANO-Antivirus	Trojan.Win32.Wecod.fmwmwh
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan.Win32.CardSpy.16000130
Ad-Aware	Gen:Heur.Mint.SP.Urelas.1
Sophos	ML/PE-A + Troj/Cardspy-G
Comodo	TrojWare.Win32.Urelas.E@51wwjn
Baidu	Win32.Trojan.Urelas.d
Zillya	Trojan.FakeAV.Win32.314405
McAfee-GW-Edition	BehavesLike.Win32.Corrupt.dc
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Heur.Mint.SP.Urelas.1 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Wecod.dh
Avira	TR/Crypt.Agent.PXL
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Win32.Trojan.PSE.13IJRMU
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Plite.R81822
Acronis	suspicious
McAfee	GenericRXAA-AA!3064C2D648E5
MAX	malware (ai score=84)
VBA32	Trojan.AVKill
Malwarebytes	Urelas.Spyware.Stealer.DDS
Rising	Spyware.CardSpy!1.A1A8 (CLASSIC)
Ikarus	Trojan.Win32.Gupboot
Fortinet	W32/Wecod.ALL!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Generic Suspicious
CrowdStrike	win/malicious_confidence_70% (D)