VirTool:WinNT/Sinowal.H removal

The VirTool:WinNT/Sinowal.H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:WinNT/Sinowal.H virus can do?

Behavioural detection: Executable code extraction – unpacking
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine VirTool:WinNT/Sinowal.H?


File Info:
name: 8A94CBF9B2DB31DC4BE1.mlw
path: /opt/CAPEv2/storage/binaries/1983185cf298eec6e68f136681890f8e092c1b609a57d7bf527eb3401e084de1
crc32: 9B75B89B
md5: 8a94cbf9b2db31dc4be14ff277a757ce
sha1: 5ec1ff0d9581d15e492271c5365f1231a0e46c18
sha256: 1983185cf298eec6e68f136681890f8e092c1b609a57d7bf527eb3401e084de1
sha512: 2ef47ef1b39438808f1fd76efab5f07c15e2df6990a410a09720c3c89f279757af956f39c684505dc653dfc3138be48c25ac1f66e4ddfe8db2eedbacc2116f89
ssdeep: 6144:VXpnhCBQYuNfS5hvVh3+z1FdnMQ4Jarhh0Fv++gLFfVAAAWxr+3iojhjdxp5qa2:VZZlNSBhwQcrhCv+DfXAWh+3iojhpP9
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1C194120287975B17C0D618F64437E7B6E898FF227700EC8F63DDE8A9A2046E597503A7
sha3_384: a9fbc9956a93cd9a0ab45f26a9d94cffadf50befc914d5f2fe039f192c2ffce13865c0943324c51f454f0eabad1962f3
ep_bytes: 8bc0558bec81ecf00000008d450883e8
timestamp: 2004-09-24 09:45:08

Version Info:
FileDescription: version Application
FileVersion: 1, 0, 0, 1
InternalName: version
LegalCopyright: Copyright (C) 2009
OriginalFilename: version.exe
ProductName: version Application
ProductVersion: 1, 0, 0, 1
Translation: 0x0409 0x04b0

VirTool:WinNT/Sinowal.H also known as:

Lionic	Trojan.Win32.Sinowal.lo7Y
DrWeb	Trojan.Packed.21724
MicroWorld-eScan	Gen:Heur.Krypt.23
FireEye	Generic.mg.8a94cbf9b2db31dc
Skyhigh	BehavesLike.Win32.Dropper.gc
McAfee	StealthMBR.h
Cylance	unsafe
Zillya	Worm.Zhelatin.Win32.2191
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Worm:Win32/Zhelatin.2229b5f2
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
BitDefenderTheta	AI:Packer.5C9673841F
Symantec	Backdoor.Tidserv
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Mebroot.CZ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Heur.Krypt.23
NANO-Antivirus	Trojan.Win32.Lampa.ftzdt
Avast	Win32:Mebload-B [Trj]
TACHYON	Worm/W32.Nuwar.417792.B
Emsisoft	Gen:Heur.Krypt.23 (B)
F-Secure	Trojan:W32/Mebroot.gen!E
VIPRE	Gen:Heur.Krypt.23
Sophos	Mal/Sinowal-Y
Ikarus	Backdoor.Win32.Sinowal
Jiangmin	Worm/Zhelatin.ve
Webroot	Vir.Tool.Gen
Google	Detected
Avira	TR/Crypt.ZPACK.Gen8
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	Win32.HeurC.KVMH008.a
Microsoft	VirTool:WinNT/Sinowal.H
Xcitium	Backdoor.Win32.Sinowal.~CRSR@1ouxzb
Arcabit	Trojan.Krypt.23
ViRobot	I-Worm.Win32.Zhelatin.417792
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Heur.Krypt.23
Varist	W32/Worm.WGDO-6249
AhnLab-V3	Trojan/Win32.Sinowal.R35300
MAX	malware (ai score=100)
VBA32	SScope.Rootkit.Sinowal
Panda	Trj/Alanchum.MV
Rising	HackTool.Sinowal!8.CDC (TFE:2:ZU3kWNDsTYK)
Yandex	I-Worm.Zhelatin!Ec1zDdTCGOo
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1281867.susgen
AVG	Win32:Mebload-B [Trj]
DeepInstinct	MALICIOUS

How to remove VirTool:WinNT/Sinowal.H?

VirTool:WinNT/Sinowal.H removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X