Virus:Win32/Emdup.A removal tips

The Virus:Win32/Emdup.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Virus:Win32/Emdup.A virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Virus:Win32/Emdup.A?


File Info:
crc32: CFEA4A70
md5: 8ebc66354f72c08ddf44269a80591167
name: 8EBC66354F72C08DDF44269A80591167.mlw
sha1: 5ef8c40c93a9c1b08723432d84260136114f0cf8
sha256: 376fc66aa23f308b9a649f1047a14a85dee4815618c143d936a72b228d5855f7
sha512: b9390111e6c76bf44e9fa46ddd884fe3b5ebeae54564c60b7a1172b40d87e9937061b187d11a2ccb7aac67614abc9a5dc12d78a73999f0020d5007925fe5b3c3
ssdeep: 3072:1myvMnbtGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB3RtP:DzlKgzelZNQSBQGH/CSpWqTKmQ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1999-2003 Microsoft Corporation.  All rights reserved.
InternalName: DW20
FileVersion: 11.0.8160
CompanyName: Microsoft Corporation
LegalTrademarks1: Microsoftxae is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windowsxae is a registered trademark of Microsoft Corporation.
ProductName: Microsoft Application Error Reporting
ProductVersion: 11.0.8160
FileDescription: Microsoft Application Error Reporting
OriginalFilename: DW20.Exe
Translation: 0x0000 0x04e4

Virus:Win32/Emdup.A also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Trojan.Crypt.63
FireEye	Generic.mg.8ebc66354f72c08d
McAfee	GenericRXMC-DI!8EBC66354F72
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 003c36381 )
BitDefender	Gen:Variant.Trojan.Crypt.63
K7GW	Trojan ( 003c36381 )
Cybereason	malicious.54f72c
TrendMicro	TROJ_GEN.R06EC0DKI20
Baidu	Win32.Worm.Agent.bg
Cyren	W32/Cosmu.J.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:WormX-gen [Wrm]
ClamAV	Win.Worm.Generic-9786786-0
Kaspersky	HEUR:Worm.Win32.Generic
Tencent	Malware.Win32.Gencirc.10b9c683
Ad-Aware	Gen:Variant.Trojan.Crypt.63
Emsisoft	Gen:Variant.Trojan.Crypt.63 (B)
Comodo	Worm.Win32.Agent.NLPA@4t56ql
F-Secure	Worm.WORM/Agent.2170901
DrWeb	Trojan.MulDrop4.6750
Invincea	ML/PE-A + W32/Renamer-V
McAfee-GW-Edition	GenericRXMC-DI!8EBC66354F72
Sophos	W32/Renamer-V
Ikarus	Worm.Win32.Agent
Jiangmin	Worm.Generic.aohc
MaxSecure	Trojan.Malware.121218.susgen
Avira	WORM/Agent.2170901
Antiy-AVL	GrayWare/Win32.Agent.nlp
Microsoft	Virus:Win32/Emdup.A
Gridinsoft	Trojan.Heur!.03012021
Arcabit	Trojan.Trojan.Crypt.63
ZoneAlarm	HEUR:Worm.Win32.Generic
GData	Gen:Variant.Trojan.Crypt.63
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.Generic.R355195
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34634.vy3@ayF79Wl
ALYac	Gen:Variant.Trojan.Crypt.63
MAX	malware (ai score=88)
VBA32	BScope.Trojan.Cosmu
Panda	Trj/Genetic.gen
Zoner	Trojan.Win32.82524
ESET-NOD32	a variant of Win32/GenKryptik.ESLP
TrendMicro-HouseCall	TROJ_GEN.R06EC0DKI20
Rising	Trojan.Generic@ML.100 (RDML:012RrKx3ltGlVQwADY0cvA)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.NLP!worm
AVG	Win32:WormX-gen [Wrm]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Virus:Win32/Emdup.A?

Virus:Win32/Emdup.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X