Trojan:Win32/Ymacco.ABF5 removal instruction

The Trojan:Win32/Ymacco.ABF5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ymacco.ABF5 virus can do?

Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Creates a hidden or system file
Creates a slightly modified copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Ymacco.ABF5?


File Info:
crc32: 62D8268F
md5: 76fa2d7d5bd9f781101b337a5bb1cff1
name: 76FA2D7D5BD9F781101B337A5BB1CFF1.mlw
sha1: 5f3322208540f8d9d17a399e1bc395abfabc8bff
sha256: f575c6773d78b3d1b4bbec481478e8667b993a069e7cb75b65bcddca10e4231e
sha512: 904fada984bc31872bae47b5cbf54a61cce3a361196d420724a0702b5be1fcc5a7dfb2978a10877e5305be94e598137b4bd0f385c1551040e81dd03ac59ed481
ssdeep: 3072:IWxKITkpasVxTZVv+hCkcIzOONTjj3onLtgX2BIOKsZ+yV:BKITkpaYHKCkPEH
type: MS-DOS executable, MZ for MS-DOS

Version Info:
LegalCopyright: xa9 1998 by Florian Bxf6mers
InternalName: IconChange
FileVersion: 1.0
Comments: http://www.bome.com
ProductVersion: 1.0
FileDescription: Icon changer package
OriginalFilename: IconChange.dpk
Translation: 0x0409 0x04e4

Trojan:Win32/Ymacco.ABF5 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Win32.HLLP.Cheval
MicroWorld-eScan	GenPack:Win32.HLLP.DeTroie.A
Cylance	Unsafe
VIPRE	Worm.Win32.Cheval.da (v)
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	GenPack:Win32.HLLP.DeTroie.A
K7GW	Trojan ( 0052964f1 )
K7AntiVirus	Trojan ( 0052964f1 )
BitDefenderTheta	Gen:NN.ZelphiF.34804.ImxaaeDtE4de
Cyren	W32/Banbra.XUEF-1609
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Alibaba	Virus:Win32/Snojan.370d581b
Rising	Trojan.Tiggre!8.ED98 (TFE:5:jvO1IMbiNyT)
Ad-Aware	GenPack:Win32.HLLP.DeTroie.A
Emsisoft	GenPack:Win32.HLLP.DeTroie.A (B)
Comodo	Virus.Win32.HLLP.DeTroie.E@n97ec
TrendMicro	TROJ_GEN.R002C0PB121
McAfee-GW-Edition	BehavesLike.Win32.Generic.hz
Sophos	Mal/Generic-R + W32/DeTroie-E
SentinelOne	Static AI – Suspicious PE – Worm
Jiangmin	Trojan.Banker.Banbra.ezu
MAX	malware (ai score=89)
Antiy-AVL	Trojan[Banker]/Win32.Banbra
Arcabit	GenPack:Win32.HLLP.DeTroie.A
ZoneAlarm	HEUR:Trojan.Win32.Snojan.gen
Microsoft	Trojan:Win32/Ymacco.ABF5
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Banbra.R259320
Acronis	suspicious
Malwarebytes	Generic.Trojan.Injector.DDS
Panda	Trj/Genetic.gen
ESET-NOD32	Win32/HLLP.DeTroie
Tencent	Virus.Win32.Hllp.aad
Ikarus	Virus.Win32.HLLP
MaxSecure	Trojan.Malware.8117164.susgen
Fortinet	W32/Banbra.BHLS!tr
AVG	Win32:Malware-gen
Cybereason	malicious.d5bd9f
Avast	Win32:Malware-gen
Qihoo-360	Win32/Virus.Detroie.HxIBAm8A

How to remove Trojan:Win32/Ymacco.ABF5?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Ymacco.ABF5 removal instruction