Trojan:Win32/Occamy.C5B removal guide

The Trojan:Win32/Occamy.C5B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Occamy.C5B virus can do?

Executable code extraction
Creates RWX memory
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Installs itself for autorun at Windows startup
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Occamy.C5B?


File Info:
crc32: FBAA3EF9
md5: 84e1faf5662e9371e659ec61d9daf85c
name: tmpasukwfn9
sha1: 697abbf1a6f130645ad06a66669244931183d849
sha256: 5b7a427059db68523dcb95964e8c5f154ae9dd41504d3fa797dc536b36b61f50
sha512: cba5188319a66d5bfacaaa55861ee819ea391990e28dc80af18f696943911d24d3b15a7fcb3c9ff510958380adb6bde4bcaed00d87cfefcaaa191d45be6dce84
ssdeep: 12288:bDcYlCX1amwYuj0+jSxS/qjO4ZY1PYK5e9JoIyXwuL5kABHaLr4qVpuUFBuSc3V:/bCX1axYuQzSB4ZY1PYK5QMnDB6Yqju
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: (c) 2006-2020 Visicom Media Inc.
FileVersion: 7.4.0.22
CompanyName: Visicom Media Inc.
ProductName: ManyCam Virtual Webcam
ProductVersion: 7.4.0.22
FileDescription: ManyCam Virtual Webcam
Translation: 0x0409 0x04b0

Trojan:Win32/Occamy.C5B also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Gen:Variant.Ursu.904612
FireEye	Generic.mg.84e1faf5662e9371
CAT-QuickHeal	Trojan.Multi
ALYac	Gen:Variant.Ursu.904612
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 00567ef31 )
BitDefender	Gen:Variant.Ursu.904612
K7GW	Trojan ( 00567ef31 )
CrowdStrike	win/malicious_confidence_90% (W)
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
GData	Gen:Variant.Ursu.904612
Kaspersky	Trojan-Banker.Win32.ClipBanker.lss
Alibaba	TrojanBanker:Win32/ClipBanker.6bad0cef
AegisLab	Trojan.Win32.ClipBanker.7!c
Rising	Trojan.Occamy!8.F1CD (CLOUD)
Ad-Aware	Gen:Variant.Ursu.904612
Emsisoft	Gen:Variant.Ursu.904612 (B)
F-Secure	Trojan.TR/Spy.Banker.aeacc
DrWeb	Trojan.MulDrop13.1707
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.THFADBO
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.VMProtect
Cyren	W32/Trojan.KTUH-0584
Webroot	W32.Trojan.Gen
Avira	TR/Spy.Banker.aeacc
MAX	malware (ai score=86)
Antiy-AVL	Trojan[Banker]/Win32.ClipBanker
Endgame	malicious (high confidence)
Arcabit	Trojan.Ursu.DDCDA4
ZoneAlarm	Trojan-Banker.Win32.ClipBanker.lss
Microsoft	Trojan:Win32/Occamy.C5B
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.RL_Generic.R340563
McAfee	RDN/Generic.grp
VBA32	BScope.TrojanDropper.Scrop
Malwarebytes	Trojan.Dropper
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Packed.VMProtect.SA
TrendMicro-HouseCall	Trojan.Win32.WACATAC.THFADBO
Tencent	Win32.Trojan-banker.Clipbanker.Eckf
Yandex	Trojan.VMProtect!
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_97%
Fortinet	W32/PossibleThreat
BitDefenderTheta	Gen:NN.ZexaF.34128.Ry0@aWmQl4hi
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.1a6f13
Paloalto	generic.ml
Qihoo-360	Generic/Trojan.171

How to remove Trojan:Win32/Occamy.C5B?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Occamy.C5B removal guide