Win32/Merond.O removal guide

The Win32/Merond.O is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Merond.O virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Network activity detected but not expressed in API logs

How to determine Win32/Merond.O?

File Info:
name: 78CE312313106985BA08.mlw
path: /opt/CAPEv2/storage/binaries/269aca7b01e603e4e3179aa86454660c0f5823aa5eb85d5820e87b7164a34985
crc32: 74690D17
md5: 78ce312313106985ba08962f08912ccd
sha1: 4bd355235e9f291a52ed5e53f74778d83b9b1194
sha256: 269aca7b01e603e4e3179aa86454660c0f5823aa5eb85d5820e87b7164a34985
sha512: b1c009433ab37e316f439f37987e2501a9571b5ee4d585f4e7df4ce99335e0494ca7e2249032a8f236d0113b10a4341827892c5ee0fc1e292eab0fb007fa2ab6
ssdeep: 24576:HHgVQTvp1nX7FOeseJ81dqQeny2VnEtA8AJGObYKlqrzdds3YXM:gVQ73oel81dEn1VbJGObYfoY8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BA252352EAD44A3BE4E9677099F456E31338FCB00B34F3AF424A448D99322C1D97979B
sha3_384: a76222f93533d25f0743b26f86f5fe3687b04a61d7c3d50e65850da6ebb07fe483515a23ec3078d9049c3c5754c59143
ep_bytes: e80a000000e97affffffcccccccccc8b
timestamp: 2004-08-04 06:01:37

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.2900.2180
Translation: 0x0409 0x04b0

Win32/Merond.O also known as:

How to remove Win32/Merond.O?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.