Should I remove “TrojanSpy:Win32/Guildma”?

The TrojanSpy:Win32/Guildma is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanSpy:Win32/Guildma virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine TrojanSpy:Win32/Guildma?


File Info:
name: 7EB370102D52D5B6B4EB.mlw
path: /opt/CAPEv2/storage/binaries/90dcef5b84678f4a9491a1520cf43e17de5b97e13a1ad5d5609438deb8cf2a40
crc32: 9223AC0F
md5: 7eb370102d52d5b6b4eb7849a51136fc
sha1: 926137a50f473bbd257cd19e207c1c9114f6b215
sha256: 90dcef5b84678f4a9491a1520cf43e17de5b97e13a1ad5d5609438deb8cf2a40
sha512: a3bd3e404b3857164005a6d5b21516450e96c20a5376e7081595279cf9ad3b98cbe91ce743fea96521e83e3002c875d9010c5db2f14099142ebd2582c6377cd3
ssdeep: 12288:fW5XRf+9bfEuUkKnntl4Z/ZKk7bBJskxfRCwXZtQKSr6kNo:i+9TExtn8Z77bfskxEUtQKSrLo
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1FCC42397E2537342F93080B86CE95B2DBE245A478F168E5A65F9804CBC83077502DF9F
sha3_384: 1137cd3cb4f76da611de90b505dfcaf81040a8ff6dfaa9e4bf7944f84294397a93b5914b25a991ac256b7989121d9391
ep_bytes: b804a164005064ff3500000000648925
timestamp: 2018-12-21 10:42:46

Version Info:
0: [No Data]

TrojanSpy:Win32/Guildma also known as:

Bkav	W32.Common.66D46118
Lionic	Trojan.Win32.Guildma.4!c
MicroWorld-eScan	Gen:Variant.Zusy.492494
ClamAV	Win.Malware.Astaroth-7052977-0
FireEye	Generic.mg.7eb370102d52d5b6
Skyhigh	BehavesLike.Win32.Dropper.hc
ALYac	Trojan.Agent.Guildma
Cylance	unsafe
Zillya	Trojan.Guildma.Win32.502
Sangfor	Riskware.Win32.Agent.ky
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanSpy:Win32/Guildma.edae0c24
K7GW	Spyware ( 00543ecc1 )
K7AntiVirus	Spyware ( 00543ecc1 )
BitDefenderTheta	Gen:NN.ZedlaF.36744.Jm4aaKSiq7m
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Guildma.AR
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Agentb.jxik
BitDefender	Gen:Variant.Zusy.492494
Avast	Win32:Trojan-gen
Tencent	Malware.Win32.Gencirc.13b7df90
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Spy.Guildma.llojy
VIPRE	Gen:Variant.Zusy.492494
TrendMicro	TrojanSpy.Win32.GUILDMA.AC
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Zusy.492494 (B)
GData	Gen:Variant.Zusy.492494
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Spy.Guildma.llojy
Antiy-AVL	Trojan/Win32.Tiggre
Kingsoft	Win32.Troj.Unknown.a
Xcitium	Malware@#2rttdagby15y9
Arcabit	Trojan.Zusy.D783CE
ViRobot	Trojan.Win32.Z.Guildma.584192
ZoneAlarm	Trojan.Win32.Agentb.jxik
Microsoft	TrojanSpy:Win32/Guildma
AhnLab-V3	Malware/Win32.Generic.C2944957
McAfee	Artemis!7EB370102D52
Malwarebytes	Spyware.Guildma
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.GUILDMA.AC
Rising	Trojan.Fuery!8.EAFB (TFE:5:zU5E2VxRh6O)
Yandex	Trojan.GenAsa!FTJhq0nyvrk
Ikarus	Trojan-Downloader.Win32.Delf
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/Guildma.AR!tr.spy
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS

How to remove TrojanSpy:Win32/Guildma?

TrojanSpy:Win32/Guildma removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X