Trojan:Win32/Chanitor.A removal

The Trojan:Win32/Chanitor.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Chanitor.A virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• A process sent information about the computer to a remote location.
• Attempts to modify proxy settings

How to determine Trojan:Win32/Chanitor.A?

File Info:
name: CF9C2B6D072B56A268B0.mlw
path: /opt/CAPEv2/storage/binaries/4878d1b2ba3406fd403533077e7203710bb0af80f2b568d6db21d12d9ad2ea69
crc32: 288110E8
md5: cf9c2b6d072b56a268b00583a1133b8c
sha1: c42864a8e3b4587bc10c7704151331e061d6a8a7
sha256: 4878d1b2ba3406fd403533077e7203710bb0af80f2b568d6db21d12d9ad2ea69
sha512: 36cfe6063e58e52900e61648a6b04b6d29bd0bd512b351530ddc30fe059d6ce5b0a2bb97a2c5c1186991ee8e30a6a2b206dbba9e16f84e9c68aa3a9b900bfbb2
ssdeep: 1536:GuivFNkrWkkpH6UFSLGOEd8ZNiked8ctGSt3RxpO8E98p7R6FoU34OHCph7P3Q0:h2QikkBTCEd83AzdxbE98RR6uOHEc0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T170A38D12B999C033D092513348AAD341573BBD2212368E57FB887BFD5FB06D15E2A39B
sha3_384: 20a36f037562f0b1ac0b65f2b5977bc2664fa2c47e042dee36bba01e866ad6093b26687f00270a73ef160d37d9e0c6a0
ep_bytes: e8813b0000e989feffff8bff558bec83
timestamp: 2014-09-29 12:12:34

Version Info:
CompanyName: ABCSoft Group
FileDescription: Graphics Remote Engine (32-bit)
FileVersion: 3.4.0.6
InternalName: Graphics Engine
LegalCopyright: Copyright (C) 2013 ABCSoft Group
OriginalFilename: remengine.exe
ProductName: Graphics Remote Engine (32-bit)
ProductVersion: 3.4.0.6
Translation: 0x0409 0x04b0

Trojan:Win32/Chanitor.A also known as:

How to remove Trojan:Win32/Chanitor.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.