TrojanSpy:Win32/Nivdort.DF malicious file

The TrojanSpy:Win32/Nivdort.DF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanSpy:Win32/Nivdort.DF virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Creates a copy of itself

How to determine TrojanSpy:Win32/Nivdort.DF?

File Info:
name: 0398013FF2599759D901.mlw
path: /opt/CAPEv2/storage/binaries/35c3fa70d782542604372a0060fab10058ba41acae76982bdbb78220bc668de3
crc32: AE8D8A12
md5: 0398013ff2599759d90134fdfde20d1c
sha1: 596920ddeca87b652fc779a32d26657dfcad5524
sha256: 35c3fa70d782542604372a0060fab10058ba41acae76982bdbb78220bc668de3
sha512: bfd3427d4518f013b07a2e232b95a6ff106e0848fd31562c4d9ef5f90aff6ad825f29c3d4239e1a484d04e9fea82e2b80cad31b3cd95a93c1e1107036d12355c
ssdeep: 6144:VZv6c/3CroIo265cgrErsNn+LtKAwwaE90eInzdegD5kor78cDb5QtPn/RKoL2Ur:T3/2rsGtKBwl36oknn5QtP/r6r8Y2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T187D48F08678A011AFCE634344452B6EEF33EDD1417935AB3E28816EC39AD79E33D5729
sha3_384: 96e8d08c81d8b8e9860bb5221ee73e817e0b26725ca5a8ac1833965b848dca2010b38714e227a0d00aceb8f79d045663
ep_bytes: e8b7670000e9000000006a1468109048
timestamp: 2014-05-28 21:46:59

Version Info:
0: [No Data]

TrojanSpy:Win32/Nivdort.DF also known as:

How to remove TrojanSpy:Win32/Nivdort.DF?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.