Categories: Trojan

How to remove “TrojanClicker:Win32/Tewand.A”?

The TrojanClicker:Win32/Tewand.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanClicker:Win32/Tewand.A virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Reads data out of its own binary image
Authenticode signature is invalid
A process attempted to delay the analysis task by a long amount of time.
Installs itself for autorun at Windows startup
Attempts to modify proxy settings

How to determine TrojanClicker:Win32/Tewand.A?


File Info:
name: 2F7EF21CF69BDF1DAB1F.mlwpath: /opt/CAPEv2/storage/binaries/fae59d49365f4da781825679994e097099916f5b2dd4e160f5be47f6517a49f8crc32: DFFDB3D4md5: 2f7ef21cf69bdf1dab1fbf70421e52cfsha1: db6b8f2e2748c92b115397c0edc0c368b3b5ba59sha256: fae59d49365f4da781825679994e097099916f5b2dd4e160f5be47f6517a49f8sha512: 1e1f8612f031479e9042e15e4e2e3525c718391171daa349e474c696f8012329cc68bf42cfddd2eecb021331b1dd4cf82dc56c4d93f0e5a49b8c88b12d48010dssdeep: 96:trQGk0cD1tFQ87XD2tdu/wO0LiWfFyGyW9vbFWicREbFwVwoSAs:trRkz1t+oXD4q0LNFXyEgbIiVwbltype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E6E1F88B1F6214B3C19F45B05817806E4ABE88352325C4F7DA33938CADE59C3B81C74Bsha3_384: 1d7b5cd0cb8ed36e65f7f774c77b061c4b181c3b2854392e57206f562ed84a21eff648ecb91944d3f62b841ca3a61673ep_bytes: 558bec83e4f8b8e4110000e8d4000000timestamp: 2011-10-04 14:07:09
Version Info:
0: [No Data]

TrojanClicker:Win32/Tewand.A also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Malware.S!dld!Z.E4359B29
FireEye	Generic.mg.2f7ef21cf69bdf1d
McAfee	Artemis!2F7EF21CF69B
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0015e4f01 )
Alibaba	TrojanClicker:Win32/Tewand.496c2579
K7GW	Riskware ( 0015e4f01 )
Cybereason	malicious.cf69bd
VirIT	Trojan.Win32.DownLoader5.RLS
Cyren	W32/Threat-HLLSI-based!Maximus
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.Agent.REA
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Agent-1156170
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.Malware.S!dld!Z.E4359B29
NANO-Antivirus	Trojan.Win32.Dwn.ksicw
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Generic.rzq
Ad-Aware	Generic.Malware.S!dld!Z.E4359B29
Sophos	Mal/Generic-S
Comodo	Suspicious@#18ec2lr2snlxz
DrWeb	Trojan.DownLoader5.11796
Zillya	Downloader.Agent.Win32.181535
TrendMicro	Mal_DLDER
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.zm
Emsisoft	Generic.Malware.S!dld!Z.E4359B29 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Generic.oiqd
eGambit	Unsafe.AI_Score_77%
Avira	TR/ATRAPS.Gen4
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.133D4B4
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	TrojanClicker:Win32/Tewand.A
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Generic.Malware.S!dld!Z.E4359B29
Cynet	Malicious (score: 100)
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34212.amW@aqMsJ!e
ALYac	Generic.Malware.S!dld!Z.E4359B29
VBA32	BScope.Trojan.Downloader
TrendMicro-HouseCall	Mal_DLDER
Rising	Downloader.Agent!8.B23 (CLOUD)
Yandex	Trojan.GenAsa!CEiB7eozEBM
Ikarus	Win32.SuspectCrc
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Dx.BBPZ!tr
Webroot	W32.Malware.Gen
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)