Win32/GenCBL.MR malicious file

The Win32/GenCBL.MR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenCBL.MR virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Presents an Authenticode digital signature
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/GenCBL.MR?


File Info:
crc32: 41A012F6
md5: ed629984841aaa362800b750a17b79da
name: ED629984841AAA362800B750A17B79DA.mlw
sha1: c0b57ee5cc518b13edb176eac08de9b12b417d4c
sha256: 5d9d07dbdf88aa8a7cbe2b0a5f7a880bb4d59e054f92ea1a321204980495bd90
sha512: cd2af94fc58fb03a44cf2c261c99a8180bb5f4ca1610111a1a9bcf27949d0707231ad2d067eab0de0c68946ea4935bde353f3509643e9d0a095bd02373750f55
ssdeep: 3072:28qk4FRozXKEI7jQC5VrmpL2zqpwAZpDpOk3+X:28qkyT7jzGl22pbZJq
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: DXPServer
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7600.16385
FileDescription: Device Stage Platform Server
OriginalFilename: DXPServer.EXE
Translation: 0x0409 0x04b0

Win32/GenCBL.MR also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.71549
FireEye	Generic.mg.ed629984841aaa36
McAfee	Artemis!ED629984841A
Cylance	Unsafe
Sangfor	Malware
BitDefender	Trojan.GenericKDZ.71549
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
Ad-Aware	Trojan.GenericKDZ.71549
Sophos	Mal/EncPk-APV
DrWeb	BackDoor.Qbot.551
TrendMicro	TROJ_GEN.R06CC0DKS20
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	MalCert.A (A)
Avira	TR/Spy.Banker.biwti
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qbot.MR!MTB
Arcabit	Trojan.Generic.D1177D
GData	Trojan.GenericKDZ.71549
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Suspig.R356667
ALYac	Trojan.GenericKDZ.71549
MAX	malware (ai score=89)
ESET-NOD32	a variant of Win32/GenCBL.MR
TrendMicro-HouseCall	TROJ_GEN.R06CC0DKS20
Rising	Trojan.MalCert!1.CF6C (CLASSIC)
Fortinet	W32/Kryptik.HDNN!tr
AVG	Win32:DangerousSig [Trj]

How to remove Win32/GenCBL.MR?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/GenCBL.MR malicious file