Categories: Malware

Win32/Farfli.CMX removal guide

The Win32/Farfli.CMX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Farfli.CMX virus can do?

Reads data out of its own binary image
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Sniffs keystrokes
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Anomalous binary characteristics

Related domains:

qq283492708.f3322.net

3600hk.no-ip.org

How to determine Win32/Farfli.CMX?


File Info:
crc32: 2CC7916Emd5: 7c61694c2f685a5ef74a324f572d1ba5name: cpzyrjcom.exesha1: 49682adf2d29099a091566a02d83769ac2107662sha256: 64a3b7090550825fd9fcec768be115d5c7cea8bfc6b7985c5ddadaecfdee8f4esha512: f08cf4f20218d2271d8d8853ab65cfaf3c50caaa7c1b12db3cfa0a5e4799a96380a447a3e0a327ae8ae5b07c4ddac07414d3a2f38c1043299290fa15843752d3ssdeep: 98304:VTcOeIdcUP6wLd5hJS+UM2AsZQIwMGu9Ujz5vNQtK1YW96SIz4tRE69:VceP5jSHM0ZQIwM0jl1QtK11USIqWGtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2012InternalName: adbrowserFileVersion: 1, 0, 0, 9CompanyName: Net.Soft StudioPrivateBuild: 20120830.01LegalTrademarks: Comments: ProductName: adbrowserSpecialBuild: ProductVersion: 1, 0, 0, 9FileDescription: P2Px7ec8x7ed3x8005x8f85x52a9x6a21x5757OriginalFilename: adbrowser.EXETranslation: 0x0804 0x04b0

Win32/Farfli.CMX also known as:

MicroWorld-eScan	Gen:Win32.Malware.@l3@aaMFFoej
FireEye	Generic.mg.7c61694c2f685a5e
CAT-QuickHeal	Trojan.Agent.20341
Qihoo-360	Win32/Trojan.5e5
ALYac	Gen:Win32.Malware.@l3@aaMFFoej
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0040f7ad1 )
BitDefender	Gen:Win32.Malware.@l3@aaMFFoej
K7GW	Trojan ( 0040f7ad1 )
Cybereason	malicious.c2f685
BitDefenderTheta	Gen:NN.ZexaF.34090.@l3@aaMFFoej
F-Prot	W32/S-6ad53990!Eldorado
Symantec	ML.Attribute.HighConfidence
Baidu	Win32.Trojan.Farfli.bg
Avast	Win32:GenMalicious-JHS [Trj]
ClamAV	Win.Trojan.Zegost-7007928-0
GData	Gen:Win32.Malware.@l3@aaMFFoej
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Backdoor:Win32/Zegost.04938354
NANO-Antivirus	Trojan.Win32.Agent.elhpas
APEX	Malicious
Tencent	Malware.Win32.Gencirc.10b753c9
Ad-Aware	Gen:Win32.Malware.@l3@aaMFFoej
Comodo	TrojWare.Win32.Kryptik.BPVQ@56xtf6
F-Secure	Backdoor.BDS/Zegost.Gen
DrWeb	Trojan.DownLoader22.4913
Zillya	Trojan.Black.Win32.47197
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.rc
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Win32.Malware.@l3@aaMFFoej (B)
SentinelOne	DFI – Malicious PE
Cyren	W32/S-6ad53990!Eldorado
Jiangmin	Trojan.Generic.aeyth
Avira	BDS/Zegost.Gen
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win32.AGeneric
Endgame	malicious (high confidence)
Arcabit	Gen:Win32.Malware.E78DE3
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Backdoor:Win32/Zegost.AD
AhnLab-V3	Trojan/Win32.Generic.R97658
Acronis	suspicious
McAfee	GenericRXDF-LU!7C61694C2F68
VBA32	BScope.Backdoor.Spy
Zoner	Trojan.Win32.52717
ESET-NOD32	Win32/Farfli.CMX
Rising	Backdoor.Farfli!1.B6C5 (RDMK:cmRtazq0LzzLPOxn46EP4KltiyS1)
Yandex	Trojan.Agent!qzuHQUHYfdI
Ikarus	Backdoor.Win32.Zegost
Fortinet	W32/Farfli.DZ!tr
AVG	Win32:GenMalicious-JHS [Trj]
CrowdStrike	win/malicious_confidence_100% (D)