Malware

UDS:NetTool.Win32.TorTool removal guide

Malware Removal

The UDS:NetTool.Win32.TorTool is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What UDS:NetTool.Win32.TorTool virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Collects information about installed applications
  • Attempts to modify proxy settings

How to determine UDS:NetTool.Win32.TorTool?



File Info:

crc32: 6B3B7484
md5: a5a16095b9f28ade6a31a17f49ce00be
name: A5A16095B9F28ADE6A31A17F49CE00BE.mlw
sha1: ea6b79389659d69085b168e3105d7c8dcb6ab7bb
sha256: b9f2d0a3ef79c8883be9adfa938d1dea808b46a2f71e56f7c0ca937922e0c971
sha512: 16e8aca29fa5c2c0dfa5199981b16db1cb3e0976f2658c650626758a174e3bbd84400cd1b51975ee56ee181a85ec6263c5f74a46bc1f1bfd780f6ead60466912
ssdeep: 6144:nwK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTSm64sl3oyBC0+eekTdFyDPckaS:wM+ZdkmHubeaCo6JVl4CvODPL
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: Tonec Inc., Copyright xa9 1999 - 2015
InternalName: IDMGrHlp
FileVersion: 6, 22, 1, 1
CompanyName: Tonec Inc.
LegalTrademarks: Internet Download Manager
Comments: Auxiliary program for Internet Download Manager
ProductName: Internet Download Manager
ProductVersion: 6, 22, 1, 1
FileDescription: Internet Download Manager module
OriginalFilename: IDMGrHlp.EXE
Translation: 0x0409 0x04b0

UDS:NetTool.Win32.TorTool also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 005827831 )
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
ALYacGen:Variant.Razy.928020
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_80% (D)
K7GWTrojan ( 005827831 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HMIU
APEXMalicious
AvastWin32:BankerX-gen [Trj]
Kasperskynot-a-virus:UDS:NetTool.Win32.TorTool
BitDefenderGen:Variant.Razy.928020
MicroWorld-eScanGen:Variant.Razy.928020
Ad-AwareGen:Variant.Razy.928020
SophosML/PE-A + Mal/EncPk-APV
BitDefenderThetaGen:NN.ZexaF.34142.2u0@aGqOSoli
McAfee-GW-EditionBehavesLike.Win32.Emotet.ct
FireEyeGeneric.mg.a5a16095b9f28ade
EmsisoftGen:Variant.Razy.928020 (B)
SentinelOneStatic AI – Malicious PE
AviraTR/AD.Dridex.rummj
Antiy-AVLTrojan/Generic.ASMalwS.1650A5
MicrosoftRansom:Win32/CerberCrypt.PB!MTB
GDataGen:Variant.Razy.928020
AhnLab-V3Trojan/Win.Generic.R441981
Acronissuspicious
McAfeeGenericRXQB-DG!A5A16095B9F2
MAXmalware (ai score=80)
VBA32BScope.TrojanDownloader.Cridex
MalwarebytesSpyware.PasswordStealer
PandaTrj/GdSda.A
RisingTrojan.Generic@ML.98 (RDML:0OITeaMYrx8CvNc2M4P2Ew)
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.HMIU!tr
AVGWin32:BankerX-gen [Trj]

How to remove UDS:NetTool.Win32.TorTool?

UDS:NetTool.Win32.TorTool removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment