TrojanDropper:Win32/Goominer.A malicious file

The TrojanDropper:Win32/Goominer.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDropper:Win32/Goominer.A virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs

How to determine TrojanDropper:Win32/Goominer.A?


File Info:
crc32: 62C1AA12
md5: 9afa2e496186d58a86c9c1fd453d8fdf
name: 9AFA2E496186D58A86C9C1FD453D8FDF.mlw
sha1: 5ecab0a6a80212d423e1217c4f4577fad20200a5
sha256: be43735ee8050f97cfb653bcfdf92c18f64c9a7bc1b9a69925461c4bd1140581
sha512: 0abd5388aa53eb1f70695d2096d89cd13cc9624919ff91829e754ec6f34106b73a5bb5c044f748fb6569bf5998623ad237fdf80eaa5f1de5aa0a3e402564abf5
ssdeep: 3072:+oycG0AzW4aPDdkfERiLLT84CrToMZp74zikOdtf8ftxyp:+oycG0ohaPDdkfEKXMZSWy10
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2013
Assembly Version: 1.0.0.0
InternalName: InstallGoogleToolBar.exe
FileVersion: 1.0.0.0
Comments: Setup/Uninstall
ProductVersion: 1.0.0.0
FileDescription: Setup/Uninstall
OriginalFilename: InstallGoogleToolBar.exe

TrojanDropper:Win32/Goominer.A also known as:

K7AntiVirus	Trojan ( 005712661 )
Lionic	Trojan.Multi.Generic.lLoj
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.MSILPerseus.181796
Cylance	Unsafe
Zillya	Dropper.Agent.Win32.180338
Sangfor	Riskware.Win32.Agent.ky
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	TrojanDropper:Win32/Goominer.2b5729f4
K7GW	Trojan ( 005712661 )
Cybereason	malicious.96186d
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.ARF
APEX	Malicious
Avast	Win32:Dropper-gen [Drp]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.MSILPerseus.181796
NANO-Antivirus	Trojan.Win32.Kazy.dbtlfz
MicroWorld-eScan	Gen:Variant.MSILPerseus.181796
Tencent	Win32.Trojan.Razy.Hyac
Ad-Aware	Gen:Variant.MSILPerseus.181796
Sophos	Mal/Generic-S
Comodo	Malware@#mnmr1s2jpvav
BitDefenderTheta	Gen:NN.ZemsilF.34236.mm0@aOrxhGo
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	GenericRXGB-BE!9AFA2E496186
FireEye	Generic.mg.9afa2e496186d58a
Emsisoft	Gen:Variant.MSILPerseus.181796 (B)
SentinelOne	Static AI – Malicious PE
Webroot	W32.Malware.Heur
Avira	HEUR/AGEN.1130458
Antiy-AVL	Trojan/Generic.ASMalwS.1906D7D
Kingsoft	Win32.Troj.Generic.v.(kcloud)
Microsoft	TrojanDropper:Win32/Goominer.A
Arcabit	Trojan.MSILPerseus.D2C624
SUPERAntiSpyware	Trojan.Agent/Gen-Kazy
GData	Gen:Variant.MSILPerseus.181796
McAfee	GenericRXGB-BE!9AFA2E496186
MAX	malware (ai score=86)
VBA32	TScope.Trojan.MSIL
Yandex	Trojan.DR.Agent!Pn/RiVDscWw
Ikarus	Trojan.Win32.Comitsproc
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.CAR!tr
AVG	Win32:Dropper-gen [Drp]
Paloalto	generic.ml

How to remove TrojanDropper:Win32/Goominer.A?

TrojanDropper:Win32/Goominer.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X