Categories: Trojan

How to remove “Trojan:Win32/Gepys.PVS!MTB”?

The Trojan:Win32/Gepys.PVS!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan:Win32/Gepys.PVS!MTB virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
A process attempted to delay the analysis task.
A process created a hidden window
Drops a binary and executes it
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Steals private information from local Internet browsers
Network activity contains more than one unique useragent.
Installs itself for autorun at Windows startup
Attempts to modify proxy settings
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/Gepys.PVS!MTB?


File Info:
crc32: 475DDF7Bmd5: f4d5c732b89e7caaa53d18dba071df10name: upp.exesha1: 5a087a3ff211bc4aedb5c2b837091b35bfc92120sha256: 19de4ea70d30d9c4163c593a76101058ef28839a226eb7d92021c67e6e832304sha512: 3a8e08388412d598cc7c8841f24a8c9f2496000752b2f6557e43474878d7a5538d3fd4d83c4dfb51994347cfc9caf8e5824510e22e72e0ae1e4ac445e5f2c76dssdeep: 3072:lsNocLcR/+M6gqx+nBNfp415wYV5W4N88KU5edNqjjjjjjjEwxS5YA:lsNvcRGzjxEA15wg5W4+RU5S1qAtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
FileOldVersionTree: 1.0.4.4InternalNameTwo: gjtrrh.exeTranslation: 0x0842 0x04c4

Trojan:Win32/Gepys.PVS!MTB also known as:

DrWeb	Trojan.PWS.Stealer.24273
MicroWorld-eScan	Trojan.GenericKD.42039164
CAT-QuickHeal	Trojanpws.Azorult
McAfee	RDN/Generic PWS.y
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0055be5e1 )
Alibaba	Trojan:Win32/Kryptik.2632b4eb
K7GW	Trojan ( 0055be5e1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D281777C
BitDefenderTheta	Gen:NN.ZexaF.32515.nyW@aOPj9jk
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GYQI
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Generickdz-7406516-0
Kaspersky	Trojan-PSW.Win32.Azorult.afvm
BitDefender	Trojan.GenericKD.42039164
Rising	Trojan.Kryptik!1.BE74 (CLASSIC)
Ad-Aware	Trojan.GenericKD.42039164
Comodo	Malware@#3jp8c65gg341e
F-Secure	Trojan.TR/Kryptik.fbfih
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
Fortinet	W32/Kryptik.GYQI!tr
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.f4d5c732b89e7caa
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.Win32.SmokeLoader
Jiangmin	Trojan.PSW.Tepfer.kdn
Webroot	W32.Trojan.GenKD
Avira	TR/Kryptik.fbfih
MAX	malware (ai score=100)
Endgame	malicious (high confidence)
Microsoft	Trojan:Win32/Gepys.PVS!MTB
ViRobot	Trojan.Win32.Z.Kryptik.212992.PT
ZoneAlarm	Trojan-PSW.Win32.Azorult.afvm
AhnLab-V3	Trojan/Win32.MalPe.R300348
Acronis	suspicious
VBA32	BScope.Backdoor.Predator
ALYac	Spyware.Infostealer.Azorult
Malwarebytes	Ransom.Stop.Generic
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R011C0PKN19
SentinelOne	DFI – Suspicious PE
GData	Win32.Trojan.Kryptik.ON
AVG	FileRepMalware
Cybereason	malicious.ff211b
Avast	FileRepMalware
Qihoo-360	Win32/Trojan.PSW.f43