About “Win32/Adware.OneStep.A” infection

The Win32/Adware.OneStep.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Adware.OneStep.A virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Authenticode signature is invalid

How to determine Win32/Adware.OneStep.A?


File Info:
name: 473E7DFBB299BC515E57.mlw
path: /opt/CAPEv2/storage/binaries/9dbe24d741a1ac75314ff89fc9c6db586fb6939a07717cfd57995f826f74a88f
crc32: 9846FB52
md5: 473e7dfbb299bc515e579e74d7f90eb7
sha1: a1009cc5e634808629cd1929ae74ad1f2bc6fd47
sha256: 9dbe24d741a1ac75314ff89fc9c6db586fb6939a07717cfd57995f826f74a88f
sha512: 4966ca699b2f78f4d83c97a57d5b09a7dd8d3b996f2d94f17fc733c9a1cc5da35f5bfd25c6a4a05cc898ad3eb1705732c0949bbe78c12633b61bc49b73178875
ssdeep: 768:1IokS90EtEMcxDG+MvnXfIXmiprU321ONbfMlODMUnFLMI:1XV904EzG+MPvVMU3aODDMUnFF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10F339E237AA2D076CD82467105ADD606AF37A6211BF0A6D35774028EEF637E11F3934B
sha3_384: be4c394983b40c14326050f94e5364e2bc3955091549ce3ad70ec8d5ec6f5b31867e604bd81e4e73f4a64911d59af56c
ep_bytes: 6a606890844000e8591f0000bf940000
timestamp: 2009-05-21 16:29:39

Version Info:
0: [No Data]

Win32/Adware.OneStep.A also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Adware.Zwangi-861
FireEye	Generic.mg.473e7dfbb299bc51
CAT-QuickHeal	Trojan.Zwangi.20038
Skyhigh	Adware-OneStep.aa
McAfee	Adware-OneStep.aa
Zillya	Adware.ZwangiCRTD.Win32.8872
Alibaba	AdWare:Win32/OneStep.b221bd52
CrowdStrike	win/grayware_confidence_90% (D)
VirIT	Adware.OneStep.F
ESET-NOD32	Win32/Adware.OneStep.A
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Zwangi.flwaih
Avast	Win32:MiscX-gen [PUP]
Tencent	Win32.Trojan.FalseSign.Snkl
F-Secure	Adware.ADWARE/Zwangi.I
Sophos	Generic ML PUA (PUA)
Jiangmin	Adware.Zwangi.u
Webroot	W32.Trojan.Connexus.Seekapp
Google	Detected
Avira	ADWARE/Zwangi.I
Antiy-AVL	Trojan/Win32.Unknown
Kingsoft	malware.kb.a.932
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	BrowserModifier:Win32/Zwangi
Varist	W32/Zwangi.D.gen!Eldorado
AhnLab-V3	Adware/Win32.Zwangi.C167259
TACHYON	Trojan-Clicker/W32.Zwangi.54760.D
Cylance	unsafe
Rising	PUF.WyyoAds!8.F7A0 (TFE:5:eKkvUyI2FDF)
Yandex	PUA.OneStep!vuRxA89SdX8
Ikarus	BHO.Win32.Zwangi
MaxSecure	Trojan.Malware.1727807.susgen
Fortinet	Adware/OneStep
AVG	Win32:MiscX-gen [PUP]
DeepInstinct	MALICIOUS

How to remove Win32/Adware.OneStep.A?

Win32/Adware.OneStep.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X