How to remove “VHO:Trojan-Spy.Win32.Carberp”?

The VHO:Trojan-Spy.Win32.Carberp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VHO:Trojan-Spy.Win32.Carberp virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine VHO:Trojan-Spy.Win32.Carberp?

File Info:
name: 96B8A291AA2B501047A4.mlw
path: /opt/CAPEv2/storage/binaries/7942ae0769b0bc27b8ba28625a1773724f9ae4c3d0d3694fca1e284826e28b44
crc32: 65C91F1A
md5: 96b8a291aa2b501047a4315da1017a9a
sha1: 41833b44b13657a5d6eb8753f3d51eea44de3458
sha256: 7942ae0769b0bc27b8ba28625a1773724f9ae4c3d0d3694fca1e284826e28b44
sha512: aea57e50cd8366f2b2da5709b61c2015860aacf32e7416c550349a5d923077e3943d813116c630558c93038d1be59b7f57d7d1fffb43f4e2b7a071d059f1d18c
ssdeep: 3072:XHeyj/UC940Qt5YhRjaP+pJeS3dZgTj5P6KVw55h:Xeyj5OoL8SeCry1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T140C3BE5B354DCA2EE52BC53A471EEDFDFA3F4CA3AB6744572D247C8264B50A01821713
sha3_384: d35a82ebde408fff0ce63aba9abb22b855fb1488dddf3a1b6e3dd3901ec6a4f1c9df0175db0c8c1a65b727258a96dce9
ep_bytes: 60be003042008dbe00e0fdff5783cdff
timestamp: 2007-02-17 00:27:48

Version Info:
CompanyName: MoRUN.net
FileDescription: MoRUN.net Sticker Lite
FileVersion: 6.3
InternalName: Sticker.exe
LegalCopyright: 2002-2010 (c) MoRUN.net.  All rights reserved.
OriginalFilename: Sticker.exe
ProductName: MoRUN.net Sticker Lite
ProductVersion: 6.3
Translation: 0x0409 0x04e4

VHO:Trojan-Spy.Win32.Carberp also known as:

How to remove VHO:Trojan-Spy.Win32.Carberp?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.