Win32/Adware.AdExpertsMedia.A malicious file

The Win32/Adware.AdExpertsMedia.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Adware.AdExpertsMedia.A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing

How to determine Win32/Adware.AdExpertsMedia.A?

File Info:
name: F42CC92CB067B9EBD58D.mlw
path: /opt/CAPEv2/storage/binaries/b74f137c733a9bf475cbbd2f4709a5d0c41c9052bc0e8c1a85dbc18dcf2c0abc
crc32: BB9A40AA
md5: f42cc92cb067b9ebd58d2713b29c252c
sha1: d094139a53b23301bc5f98b3d53c9e93052c0838
sha256: b74f137c733a9bf475cbbd2f4709a5d0c41c9052bc0e8c1a85dbc18dcf2c0abc
sha512: 73eff58d5b183c109396862c9112ac58dccac22ccbdd8f019bc330fe663cb5afa3a0e8ddec20ae327ec894db73882e80f5b92707b754d057d2ee60d0d4adaecb
ssdeep: 393216:RfAlhvR8PZ5ECts3Rztsr5PSL0g7+Pgkt7/7xT:qlhv2O1tfZi7/p
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FDF63351EBCA883BE9D607B2550797E01F135DAC58D06B6A7DF5E30E84B8887FCB0A41
sha3_384: 93627e487ad3a9b151bf018159f1cc8870ebcd9e4eb52d86ca11f425b84c387e19d931f10a5801bbc8521d575f652e53
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2012-10-02 05:04:04

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: Global Media (Thailand) Co., Ltd                            
FileDescription: MaskVPN Setup                                               
FileVersion: 1.1.0.31            
LegalCopyright: Copyright © 2020 Global Media (Thailand) Co., Ltd. All rights reserved.                             
ProductName: MaskVPN                                                     
ProductVersion: 1.1.0.31            
Translation: 0x0000 0x04b0

Win32/Adware.AdExpertsMedia.A also known as:

How to remove Win32/Adware.AdExpertsMedia.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.