What is “Universal Virus Sniffer (PUA)”?

The Universal Virus Sniffer (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Universal Virus Sniffer (PUA) virus can do?

• Creates an indicator observed in Territorial Disputes report SIG40
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Creates an autorun.inf file
• Authenticode signature is invalid
• Emumerates physical drives
• Accessed credential storage registry keys
• Attempts to interact with an Alternate Data Stream (ADS)
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Universal Virus Sniffer (PUA)?

File Info:
name: 0A4E29E187CDD9B47FC5.mlw
path: /opt/CAPEv2/storage/binaries/2579bdb8b9c0fc973da61b163d136ef9c3d7e8b2b4901975b109792576759d66
crc32: FAA9A9BC
md5: 0a4e29e187cdd9b47fc55bd163c8e06a
sha1: 3fd7fdc12af5bba7f9a84b1c3b31f86ad7ddffe8
sha256: 2579bdb8b9c0fc973da61b163d136ef9c3d7e8b2b4901975b109792576759d66
sha512: ea6ce693bccfa60f873533a5f23cf848e180e537feb7d4a200df847b6bf81a8ff722bebb6a7f831f6b6662c7ef4ecf2947fa7c943daec761a4b994717e826d17
ssdeep: 12288:UtduOOJ7rfUjuz8HVF/qsrfHPXx8gz9mlmNGyoSq:cdu5JnfUjf/L5mQNGT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14A842375DFB8DA1CC34C60749837165DF648C74DE88C0B8B9606AC3FBE457265E8E1A2
sha3_384: 0326d99ee10038cc6719c9868ed0e88265cfe44d154ded06202f408d9c36b546acd4646e0c6a99d31e28098948c25a21
ep_bytes: 60be00505b008dbe00c0e4ff5789e58d
timestamp: 2015-06-19 10:14:53

Version Info:
0: [No Data]

Universal Virus Sniffer (PUA) also known as:

How to remove Universal Virus Sniffer (PUA)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.