Should I remove “Trojan:Win32/Farfli.MO!MTB”?

The Trojan:Win32/Farfli.MO!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Farfli.MO!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• A process attempted to delay the analysis task by a long amount of time.
• CAPE detected the PCRat malware family

How to determine Trojan:Win32/Farfli.MO!MTB?

File Info:
name: 722657184BA477F5BBD3.mlw
path: /opt/CAPEv2/storage/binaries/d2f54641ba6ec6b23af2469fc97f4187893b1976f24a60097e79ec28e34fa57c
crc32: 387B06AD
md5: 722657184ba477f5bbd3670e65242ef1
sha1: 904179fbf40e12cbd2e3457f3e3f40182bf86dfc
sha256: d2f54641ba6ec6b23af2469fc97f4187893b1976f24a60097e79ec28e34fa57c
sha512: 46547a097043071686b9ae8621fcfea8ab8d30660084cd3a23f70c60dbfdae8b2a2ddd1368b1ebf761f5237cef2f3f882d59fce1473a6fb9772a43ad30ca063d
ssdeep: 12288:0mtY05k9nhdsNKp9FVqXcmtY05k9nhdsNKp9w:0mJO2uLqMmJO2uw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T185055BCDA8515676C4CF1830BC5E268C1DB82DD0EB3495FF9A78398A99313D0AC7A91F
sha3_384: 9f47ac5989fa92d2e353083323d7987c64f18b4982e4bc3bd9206627a832fb8dc01b9f2cfa2e04ea9935aa2d9ce1dee6
ep_bytes: 558bec6aff684850410068a468400064
timestamp: 2014-01-29 06:47:13

Version Info:
CompanyName: 
FileDescription: 
FileVersion: 
InternalName: 
LegalCopyright: 
OriginalFilename: 
ProductName: 
ProductVersion: Eudora . 2.0
Translation: 0x040f 0x04b0
Comments: 
LegalTrademarks: 
PrivateBuild: 
SpecialBuild: Eudora .
LegalCopydright: 
LegaldTrademarks: 
OriginadlFilename: Eudora .
PrivatedBuild: 
ProductdName: 

Trojan:Win32/Farfli.MO!MTB also known as:

How to remove Trojan:Win32/Farfli.MO!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.