Trojan:Win32/Desurou.C removal instruction

The Trojan:Win32/Desurou.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Desurou.C virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Desurou.C?


File Info:
name: 44A7F87519DD969A284B.mlw
path: /opt/CAPEv2/storage/binaries/c2e5999cc242748b6b240c5493c2eef45f397e5fce3d89b9bcd7e7bb9a6a3a37
crc32: DD0102E5
md5: 44a7f87519dd969a284baf045a962a51
sha1: e104eea4910e827794d124a66d5076948812b70e
sha256: c2e5999cc242748b6b240c5493c2eef45f397e5fce3d89b9bcd7e7bb9a6a3a37
sha512: ff989ec0eb21f4a2840103663bf2c87e946bc67dd9d3cd8664ff3b8cacd3a8c7a4004f25773f7566dcb88418424665fae564481e8ea5aa3419a240b21d258180
ssdeep: 3072:FATI4w2i5jKHqc7JCcOuorke+fb7vgBtDQ:+TI4w2i5jKHqc7JToez7vK9Q
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13AD3F803AA8C805BF65087F028BB51AB7D167D391A926D0B11C6FF5D183168379F5B2F
sha3_384: 675f1c23544327ff66fccec23be2ea9e5bbe6deb3880a07234dd88e44aefbb4900b18e6bcf7c10907021601746f90511
ep_bytes: 6874274000e8eeffffff000000000000
timestamp: 2010-03-21 09:59:38

Version Info:
Translation: 0x0409 0x04b0
CompanyName: QH
ProductName: QH
FileVersion: 1.00
ProductVersion: 1.00
InternalName: 112113
OriginalFilename: 112113.exe

Trojan:Win32/Desurou.C also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.VB.8!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.452392
ClamAV	Win.Malware.A4cnnroi-9757892-0
CAT-QuickHeal	Trojan.Desurou
ALYac	Gen:Variant.Bulz.452392
VIPRE	Gen:Variant.Bulz.452392
Sangfor	Suspicious.Win32.Save.vb
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Trojan.BHO.g
VirIT	Trojan.Win32.Startpage.JHF
Cyren	W32/AdClicker.K.gen!Eldorado
Symantec	Trojan.Adclicker
tehtris	Generic.Malware
ESET-NOD32	Win32/TrojanDropper.Agent.OQI
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Bulz.452392
NANO-Antivirus	Trojan.Win32.Agent.bavgu
Avast	Win32:Evo-gen [Trj]
Tencent	Malware.Win32.Gencirc.10b7ecec
Emsisoft	Gen:Variant.Bulz.452392 (B)
F-Secure	Trojan:W32/Hobwy.A
DrWeb	Trojan.DownLoader10.25023
Zillya	Trojan.VB.Win32.31919
TrendMicro	TROJ_STRTPG.SMS
McAfee-GW-Edition	BehavesLike.Win32.Swisyn.ct
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.44a7f87519dd969a
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Bulz.452392 (2x)
Jiangmin	TrojanClicker.VB.fha
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[Clicker]/Win32.VB
Xcitium	TrojWare.Win32.TrojanClicker.VB.NNM@1ql3ud
Arcabit	Trojan.Bulz.D6E728 [many]
ViRobot	Trojan.Win32.A.Clicker.134044
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Desurou.C
Google	Detected
AhnLab-V3	Trojan/Win32.VB.R23429
Acronis	suspicious
McAfee	W32/Rimecud.gen.at
MAX	malware (ai score=89)
VBA32	Trojan.VB.01018
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_STRTPG.SMS
Rising	Malware.Undefined!8.C (TFE:3:AcYlrHDUs0U)
Yandex	Trojan.GenAsa!A9uR4eHQpFA
Ikarus	Trojan-Dropper.Agent
Fortinet	W32/VB.ACTE!tr
BitDefenderTheta	Gen:NN.ZevbaF.36318.cm0@a048eQmi
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.519dd9
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Desurou.C?

Trojan:Win32/Desurou.C removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X