Virus:Win32/Mariofev.A (file analysis)

The Virus:Win32/Mariofev.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Virus:Win32/Mariofev.A virus can do?

Unconventionial language used in binary resources: Hungarian
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Virus:Win32/Mariofev.A?


File Info:
name: 99DD367F3EB31B62420F.mlw
path: /opt/CAPEv2/storage/binaries/50fa02677e56a8affe57e395ab57eef3e90d7b54ef78efb3cd2a77d1b7484eab
crc32: 46D4DEEA
md5: 99dd367f3eb31b62420f499728e86bf3
sha1: abf4b409ac02de2f8393cd2632d787b5f18cf3ed
sha256: 50fa02677e56a8affe57e395ab57eef3e90d7b54ef78efb3cd2a77d1b7484eab
sha512: b5ef64838dab39d4ad68f0bde5897a1c9a1f42067b9db753aedf11d311c264793116eb155fb27ba639be3e5c82c5cb9c162fd0f8ae7b0c86da147f3846ab70c8
ssdeep: 12288:/18umLEk+acny1NQSrpnaex3g4d2rDtS0/n:/hmT+acUNQCpa2g4doDtSo
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T11DC44A12B6D1D061D2A2163165ABF3B187A9AD39042CF60FD994FE3A7970183C737A4F
sha3_384: 0681b8d2fa89dd46f66e4791800198d95d3896d63e4f81bcef49eb937720527c1acac8571c634c8c602247c47dbe9b25
ep_bytes: 8bff558bec837d0c017505e85d070000
timestamp: 2004-08-17 23:45:55

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows XP USER API ügyfél DLL
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: user32
LegalCopyright: © Microsoft Corporation. Minden jog fenntartva.
OriginalFilename: user32
ProductName: Microsoft® Windows® operációs rendszer
ProductVersion: 5.1.2600.2180
Translation: 0x040e 0x04b0

Virus:Win32/Mariofev.A also known as:

Lionic	Trojan.Win32.Patched.4!c
MicroWorld-eScan	Win32.MarioForever.Patched
FireEye	Win32.MarioForever.Patched
CAT-QuickHeal	Trojan.Patched.AP
Skyhigh	Patched User32.a
McAfee	Patched User32.a
Cylance	unsafe
VIPRE	Win32.MarioForever.Patched
CrowdStrike	win/malicious_confidence_70% (D)
BitDefenderTheta	AI:FileInfector.2CE34A511A
Symantec	Trojan.Gen.6
ESET-NOD32	Win32/Pinit
Cynet	Malicious (score: 99)
Kaspersky	Trojan.Win32.Patched.dr
BitDefender	Win32.MarioForever.Patched
NANO-Antivirus	Trojan.Win32.Patched.dsvwgv
ViRobot	Win32.Patched.X
Avast	Win32:SysPatch [Wrm]
Emsisoft	Win32.MarioForever.Patched (B)
F-Secure	Trojan.TR/Patched.Gen2
DrWeb	BackDoor.Zapinit
Zillya	Trojan.Patched.Win32.7277
TrendMicro	Possible_Patch-1
Sophos	Troj/User32Hk-A
GData	Win32.MarioForever.Patched
Jiangmin	Win32/PatchFile.gn
Webroot	Virus:Win32/Mariofev.A
Google	Detected
Avira	TR/Patched.Gen2
Kingsoft	Win32.Patched.bb.10
Xcitium	TrojWare.Win32.Patched.F@1f0ghc
Arcabit	Win32.MarioForever.Patched
ZoneAlarm	Trojan.Win32.Patched.dr
Microsoft	Virus:Win32/Mariofev.A
Varist	W32/Patched.AB.gen!Eldorado
AhnLab-V3	Win-Trojan/User32Hk
MAX	malware (ai score=80)
Panda	W32/Patched.D
TrendMicro-HouseCall	Possible_Patch-1
Rising	Trojan.Win32.Patched.bi (CLASSIC)
MaxSecure	Virus.Patched.DR
Fortinet	W32/Patched.D!tr
AVG	Win32:SysPatch [Wrm]
DeepInstinct	MALICIOUS

How to remove Virus:Win32/Mariofev.A?

Virus:Win32/Mariofev.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X