How to remove “Win32/Danmec.C”?

The Win32/Danmec.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Danmec.C virus can do?

• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Attempts to modify proxy settings
• Touches a file containing cookies, possibly for information gathering
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Win32/Danmec.C?

File Info:
name: D1D3DA95059A5B62FA7E.mlw
path: /opt/CAPEv2/storage/binaries/68349ed67be4b99b60e1569292d897492f1192cc449f6d21a2a237103d59571c
crc32: 6C6FAE8E
md5: d1d3da95059a5b62fa7e14ef1d445750
sha1: 0797c62528ac0e6f0f9b248d3e40b0d135d56941
sha256: 68349ed67be4b99b60e1569292d897492f1192cc449f6d21a2a237103d59571c
sha512: 90d0002ecc4bde748c13336061c5511f2044353ffd24927d79a9bb379465fee92fe4b91484ff0c9d91e3739d4b4aff00c5b8aa96ecd1d4973f8217f5939f94d6
ssdeep: 1536:fKaouK0rof8925RMehGW4S6cHiP3jqshuqRCdPf:fKaouK99MqB4SY3ln6X
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T186636C47D5109573E230193238A4337283EF7DB52D92FC9AD7921F8A192E1D2BE7A607
sha3_384: 41ad3150a5d31c4d525ce378a2137d033dfffb57c572e543a9485a5ccd26de07d26dbdcbc4b4b32ceab091efc0535268
ep_bytes: 558bec83ec208b450c5333db2bc357c7
timestamp: 2011-09-15 11:39:05

Version Info:
CompanyName: Potao
FileDescription: Potao spambot
FileVersion: 1.0.0.1
InternalName: potaospam.dll
LegalCopyright: Copyright (C) 2011 Potao INC.
OriginalFilename: Svc.exe
ProductName: Potao hide spambot
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04b0

Win32/Danmec.C also known as:

How to remove Win32/Danmec.C?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.