TrojanDownloader:Win32/Ufraie.A removal guide

The TrojanDownloader:Win32/Ufraie.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Ufraie.A virus can do?

• Executable code extraction
• Starts servers listening on 0.0.0.0:10100
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• HTTP traffic contains suspicious features which may be indicative of malware related traffic
• Performs some HTTP requests
• Unconventionial binary language: Russian
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Uses Windows utilities for basic functionality
• Queries information on disks, possibly for anti-virtualization
• Network activity contains more than one unique useragent.
• Collects information about installed applications
• Attempts to modify proxy settings
• Collects information to fingerprint the system

Related domains:

How to determine TrojanDownloader:Win32/Ufraie.A?

File Info:
crc32: 4C94A36F
md5: ddd0bdc1f2ae1253870b43c1962a8163
name: DDD0BDC1F2AE1253870B43C1962A8163.mlw
sha1: b4171c9c0e05739d0bff26a3e816abe72bc8082b
sha256: 5b6b02f7a597fd23c75aded695722a04a06cecfb89e5aeec54701b7c27c7bca6
sha512: 06acb8874b039bd9b8e58e8764a3c9e9fed5f05ebeac6117665f88f7ab7c56ffa7e0f56f25f1f47801186a9ea04cf77493c4b4f863ba56b66d324fd65244af66
ssdeep: 1536:H0iGPNkpLBOGp8mXhdT7et8TyzUpt23nouy8xFvJ3/FK1SIz:TG1kLxpvxdpTyznoutvG
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: SensApi.dll
FileVersion: 5.1.2600.5512 (xpsp.080413-2108)
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 5.1.2600.5512
FileDescription: SENS Connectivity API DLL
Translation: 0x0419 0x04b0

TrojanDownloader:Win32/Ufraie.A also known as:

How to remove TrojanDownloader:Win32/Ufraie.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.