About “Trojan:Win32/Pincav.NPC!MTB” infection

The Trojan:Win32/Pincav.NPC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Pincav.NPC!MTB virus can do?

• A file was accessed within the Public folder.
• Sample contains Overlay data
• HTTPS urls from behavior.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the shellcode patterns malware family
• Operates on local firewall’s policies and settings
• Deletes executed files from disk
• Attempts to disable Windows Auto Updates
• Attempts to modify or disable Security Center warnings
• Modifies Image File Execution Options, indicative of process injection or persistence
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Pincav.NPC!MTB?

File Info:
name: D268269D52BFB11544E8.mlw
path: /opt/CAPEv2/storage/binaries/c15f4ef2164166f99d4b0538d37110d04be28080afa6fa74002d642e33df2aae
crc32: 698331BB
md5: d268269d52bfb11544e85baa31a06a90
sha1: b42ce5f8fdcdd721566717f036277065168c6d54
sha256: c15f4ef2164166f99d4b0538d37110d04be28080afa6fa74002d642e33df2aae
sha512: 781b144806e10bafbfadb258a05940c0705e532c305f2a1ca1a8e5ff52c11f259de8b68435d4b8f9c781fa15ef95f1b97b86fe3f7afc76f4890d27348c1c34a0
ssdeep: 1536:1YF8NLCofRLCg/pdsHT+obdo8Cgzvl4ooofgke253Q:uF+LCofRLCgxSzXo8CgpIo53Q
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13B735D722D013EDAEA3D563772FA719515A19CE3D8BE450EFF0A1CAA415127B138B30B
sha3_384: f1605391bd2d1cfcb9b18edd17a4520c2f8da1db3a6ef45dbe343e2ccf6e186199a222d4eb628bbc3fb8a95f6f338059
ep_bytes: 5557565381ecc8090000c78424bc0000
timestamp: 2008-08-04 21:06:40

Version Info:
0: [No Data]

Trojan:Win32/Pincav.NPC!MTB also known as:

How to remove Trojan:Win32/Pincav.NPC!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.