Categories: Trojan

Trojan:Win32/SystemHijack!C removal guide

The Trojan:Win32/SystemHijack!C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/SystemHijack!C virus can do?

Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Uses Windows utilities for basic functionality
Authenticode signature is invalid
Creates a copy of itself
Attempts to disable System Restore
The sample wrote data to the system hosts file.
Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/SystemHijack!C?


File Info:
name: DD045104BA038E62377F.mlwpath: /opt/CAPEv2/storage/binaries/abd3fa468191f60175d62c5286c10aa643410f5d18e5e88f1d55572045c42426crc32: 131CF470md5: dd045104ba038e62377f3dedb6bd18f1sha1: 0b1373e4c92ab461fcf57891c8e7ac4106687d66sha256: abd3fa468191f60175d62c5286c10aa643410f5d18e5e88f1d55572045c42426sha512: c0e79a90637ea633372338fce5fbe4935e3ea7037957fefdcb537c778ad8ae68d3ce4610fb47780ac459543f7ac379249875290259fdcd7de6d89d43fdd1cf73ssdeep: 768:34Fg8+UAq4OwSRNFdv7QuhQ0KTM/0V6F0Et73cVkWReq6caN12Dt6QUAKE9XpCL6:IEbjDtCqdK/rjQiTZnQqN+type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1132386760B4E69FCF1514271BB44722D41A3173C03FAE792ABE764E182218B646F2D7Bsha3_384: 74536305af8ab251036cc516505ff0cdf781e7fdabe75f47db158c67a0ceced3aeed13a4aabcb2f35e00ad44c10a5bd4ep_bytes: 558bec81ec980700005356576a01ff15timestamp: 2008-08-14 02:36:30
Version Info:
0: [No Data]

Trojan:Win32/SystemHijack!C also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.IRCBot.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Win32.Worm.Slenfbot.AI
FireEye	Generic.mg.dd045104ba038e62
Skyhigh	BehavesLike.Win32.Generic.ph
McAfee	PUP-XVQ-CY
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Backdoor:Win32/IRCBot.53630022
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	AI:Packer.69DAB0C21E
VirIT	Backdoor.Win32.IRCBot.GTX
Symantec	W32.IRCBot
ESET-NOD32	a variant of Win32/AutoRun.Qhost.A
APEX	Malicious
TrendMicro-HouseCall	TROJ_AGENT.ASZF
Kaspersky	Backdoor.Win32.IRCBot.gtx
BitDefender	Dropped:Win32.Worm.Slenfbot.AI
NANO-Antivirus	Trojan.Win32.IRCBot.bjnyuo
Avast	Win32:Agent-WOW [Trj]
Tencent	Win32.Backdoor.Ircbot.Simw
Emsisoft	Dropped:Win32.Worm.Slenfbot.AI (B)
F-Secure	Trojan.TR/Spy.Gen
DrWeb	Win32.HLLW.Autoruner.3733
VIPRE	Dropped:Win32.Worm.Slenfbot.AI
TrendMicro	TROJ_AGENT.ASZF
Trapmine	malicious.high.ml.score
Sophos	Mal/Behav-001
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=100)
Jiangmin	Heur:Backdoor/IRCBot
Google	Detected
Avira	TR/Spy.Gen
Varist	W32/Bifrost.C.gen!Eldorado
Antiy-AVL	Trojan[Backdoor]/Win32.IRCBot
Kingsoft	Win32.HeurC.KVMH012.a
Microsoft	Trojan:Win32/SystemHijack.gen!C
Xcitium	Malware@#w1oitt87873d
Arcabit	Win32.Worm.Slenfbot.AI
ZoneAlarm	Backdoor.Win32.IRCBot.gtx
GData	Dropped:Win32.Worm.Slenfbot.AI
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.Generic.R581101
Acronis	suspicious
VBA32	BScope.Trojan-Dropper.1291
ALYac	Dropped:Win32.Worm.Slenfbot.AI
Panda	Generic Malware
Rising	Trojan.SystemHijack!8.82E (TFE:5:ZXTzAiyT4n)
Yandex	Trojan.GenAsa!prHfpLFtpY4
Ikarus	Worm.Win32.Slenfbot.B
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat
AVG	Win32:Agent-WOW [Trj]
Cybereason	malicious.4ba038
DeepInstinct	MALICIOUS
alibabacloud	Backdoor:Win/Qhost.A