Categories: Virus

How to remove “Virus:Win32/Ravs.A”?

The Virus:Win32/Ravs.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Ravs.A virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
CAPE detected the embedded win api malware family
Attempts to disable Windows File Protection aka System File Checker.
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Ravs.A?


File Info:
name: FA35C13473940BDF9904.mlwpath: /opt/CAPEv2/storage/binaries/f1603c496b7e0378fab448f8719c2bae041e1e106d80a9f626c5ff2eb891ecebcrc32: 925CEB6Cmd5: fa35c13473940bdf99042c4539265f4dsha1: 92a5b338fbe788db6ec8c97f84a74503ecb1ed58sha256: f1603c496b7e0378fab448f8719c2bae041e1e106d80a9f626c5ff2eb891ecebsha512: ca2c8931b33a694517e1a7efe39cf538e0744b12f4eb270bba0f60ddc1c79ba6439d6b2c31824d5deeeb7855cc9b9676de51e6c254c34fd1ff138c92ee72ddd4ssdeep: 6144:278n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFOsv:Q85bM3npxYfj63hgD1ZiGtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T189B41902B7E99135F6F31B31AEB592615A7BBC619D35C20F23C41A0D0DB0A90EA75B73sha3_384: 07643fd67c8a1d82a14c2637aabe32896a6921eb7e7aa9ccdd96cea9ebe2e8690bbde5fd36e027b4146102acde2a5b87ep_bytes: 56e871040000034405006e9203007a91timestamp: 2018-09-20 03:00:31
Version Info:
CompanyName: Adobe Systems IncorporatedFileDescription: Adobe Bootstrapper for Single InstallationFileVersion: 19.8.20071.303822InternalName: Setup.exeLegalCopyright: Copyright © 2018 Adobe Systems Incorporated.  All rights reserved.OriginalFilename: Setup.exeProductName: Bootstrapper SmallProductVersion: 19.8.20071.303822Translation: 0x0409 0x04e4

Virus:Win32/Ravs.A also known as:

Bkav	W32.SVConfDropper.PE
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Ravs.9
ClamAV	Win.Trojan.Davs-3
FireEye	Win32.Ravs.9
CAT-QuickHeal	W32.Ravs.A
Skyhigh	BehavesLike.Win32.Sality.gh
McAfee	W32/Davs
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Virus.Ravs.Win32.4
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Virus ( 7000000b1 )
K7GW	Virus ( 7000000b1 )
Cybereason	malicious.8fbe78
Baidu	Win32.Virus.Ravs.a
VirIT	Win32.DAT.G
Symantec	W32.Davs!inf
ESET-NOD32	Win32/Ravs.A
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Virus.Win32.Ravs.a
BitDefender	Win32.Ravs.9
NANO-Antivirus	Virus.Win32.Ravs.bmntb
Avast	Win32:Ravs
Tencent	Virus.Win32.Dropper.ja
Sophos	W32/Davs-A
F-Secure	Malware.W32/Ravs.A
DrWeb	Win32.Ravs.45056
VIPRE	Win32.Ravs.9
TrendMicro	PE_DAVS.A
Emsisoft	Win32.Ravs.9 (B)
Ikarus	Virus.Win32.Ravs.a
GData	Win32.Ravs.9
Jiangmin	Win32/Davs.a
Webroot	W32.Virus.Gen
Google	Detected
Avira	W32/Ravs.A
Antiy-AVL	Virus/Win32.Ravs.a
Kingsoft	Win32.Ravs.a.39728
Xcitium	Virus.Win32.Ravs.a0@1c5hj3
Arcabit	Win32.Ravs.9
ViRobot	Win32.Ravs.A
ZoneAlarm	Virus.Win32.Ravs.a
Microsoft	Virus:Win32/Ravs.A
Varist	W32/Davs.A
AhnLab-V3	Win32/Ravs
Acronis	suspicious
BitDefenderTheta	AI:FileInfector.CE5DA3D70C
ALYac	Win32.Ravs.9
MAX	malware (ai score=86)
VBA32	Virus.Ravs.a
Cylance	unsafe
Panda	W32/Ravs.A
TrendMicro-HouseCall	PE_DAVS.A
Rising	Worm.Davs.a (CLASSIC)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Virus.W32.Ravs.A
Fortinet	W32/Davs.A
AVG	Win32:Ravs
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)