Win32/AnMalPro.F potentially unwanted removal guide

The Win32/AnMalPro.F potentially unwanted is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/AnMalPro.F potentially unwanted virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/AnMalPro.F potentially unwanted?


File Info:
name: 006CA029D43C599CA55A.mlw
path: /opt/CAPEv2/storage/binaries/cefc929762d1798b3b31b217110bbe0f2441089191032cda99adbe5a483b532c
crc32: 7694D3E5
md5: 006ca029d43c599ca55ae777fdbdc2bb
sha1: 7059908aed0f54d579fe13f2cfac1af4468142de
sha256: cefc929762d1798b3b31b217110bbe0f2441089191032cda99adbe5a483b532c
sha512: 196901bf7cb70aa4396db6f78c2b0f3c1ad994d9e6ee64bed2e1f6144ead03982e0f44a6a388073323b356d3e4effd138fc926db37c38fdfc2e5644402900ce8
ssdeep: 24576:yI2q2TupHRBkJbEl4fIUejI9hvZ9Fj1QUM43CNh1ETiJ0WyTAPlANNmx:nVdWI/cPvZ9p13MR1ET+0WyTKlANNI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T125259F10BB82D033CA57147106F9D76E6A7BA62007325ACBEBD81D7A5F702D1763A34B
sha3_384: 4dd4024256c99540ec7834caa066132eec381443195f617f5b06808232fb65be72008dc3c503bb9c57e53a818739b64f
ep_bytes: e8ea900000e979feffff8bff558bec83
timestamp: 2021-02-21 20:25:04

Version Info:
CompanyName: Advanced System Repair Inc.
FileDescription: Advanced System Repair Pro Service
FileVersion: 1.9.4.0
InternalName: Advanced System Repair Pro Service
LegalCopyright:  Advanced System Repair, Inc.
OriginalFilename: Advanced System Repair Pro
ProductName: Advanced System Repair Pro
ProductVersion: 1.9.4.0
Translation: 0x0409 0x04b0

Win32/AnMalPro.F potentially unwanted also known as:

DrWeb	Program.Unwanted.4508
FireEye	Generic.mg.006ca029d43c599c
Malwarebytes	PUP.Optional.AdvancedSystemRepair
ESET-NOD32	a variant of Win32/AnMalPro.F potentially unwanted
APEX	Malicious
Avast	Win32:MiscX-gen [PUP]
Sophos	Generic ML PUA (PUA)
Ikarus	PUA.AnMalPro
Microsoft	PUA:Win32/PCClean
MaxSecure	Trojan.W32.Redyms.vho_263176
AVG	Win32:MiscX-gen [PUP]
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_70% (D)

How to remove Win32/AnMalPro.F potentially unwanted?

Win32/AnMalPro.F potentially unwanted removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X