Categories: Malware

Win32/Packed.AutoIt.KL removal tips

The Win32/Packed.AutoIt.KL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.AutoIt.KL virus can do?

Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Deletes its original binary from disk
Network activity contains more than one unique useragent.
Creates a hidden or system file
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to modify proxy settings
Creates a copy of itself

Related domains:

yip.su

How to determine Win32/Packed.AutoIt.KL?


File Info:
crc32: 3433D2ACmd5: 4449b10079c037ee122ab71b5a498301name: 4449B10079C037EE122AB71B5A498301.mlwsha1: edc87274f102c0bccff54fd9724ed5999d9c5a2fsha256: fabd6718ee932e0f59ac30ef49de2f553f6224b8ab0d74e6d3121567fa255e02sha512: 17564e8b326fc2c20de00ae3adacc75e759ba06eafd70f84e9273e35f40297b1e836ba8a101f4b703ca90f0a6923fc5351ba1395661945392eb65722bf0d814fssdeep: 24576:zAHnh+eWsN3skA4RV1Hom2KXMmHa6bBnbWGpkS+ikOGG4UP99R5:+h+ZkldoPK8Ya6VbWGeXK4UPPtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: (C) e418Sg1ABfPFXaI8LYDRwa8eMSkEOZv8Cpq7x9wTXZ6bHova3d9c48zfkBkVT Technology Co. Ltd., All rights reserved.InternalName: cttune.exeFileVersion: 4.1.4.7CompanyName: Windows Connect Now - WCN EAP PEER ProxyComments: HcPxuSyiGcp1y722yS2MZ8U9bfM1592mDbYyWOpTMcTDZAryqc4pFXpGzcbV2ce8Q2wtE5c1WECAZWPnsVvMsZHNCbRMRLhSerFeil3gUZN1sSEProductVersion: 4.1.4.7FileDescription: Microsoft Neutral Natural Language Server Data and CodeOriginalFilename: cttune.exeTranslation: 0x0809 0x04b0

Win32/Packed.AutoIt.KL also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 700000111 )
Lionic	Hacktool.Win32.Gamehack.3!e
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader27.21384
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.AutoIT.17lv0@aqnf@Qni
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Malware:Win32/km_2c67698.None
K7GW	Trojan ( 700000111 )
Cybereason	malicious.079c03
Cyren	W32/AutoIt.HJ.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Packed.AutoIt.KL
APEX	Malicious
Avast	FileRepMalware
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	Gen:Trojan.Heur.AutoIT.17lv0@aqnf@Qni
NANO-Antivirus	Trojan.Win32.Mlw.flfvht
MicroWorld-eScan	Gen:Trojan.Heur.AutoIT.17lv0@aqnf@Qni
Ad-Aware	Gen:Trojan.Heur.AutoIT.17lv0@aqnf@Qni
Sophos	Mal/Generic-S
Comodo	Malware@#26ai5tew7u070
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.tc
FireEye	Generic.mg.4449b10079c037ee
Emsisoft	Gen:Trojan.Heur.AutoIT.17lv0@aqnf@Qni (B)
Avira	HEUR/AGEN.1100133
eGambit	Unsafe.AI_Score_98%
Microsoft	Trojan:Win32/CoinMiner.C!rfn
GData	Gen:Trojan.Heur.AutoIT.17lv0@aqnf@Qni
McAfee	Artemis!4449B10079C0
MAX	malware (ai score=100)
VBA32	Trojan.CoinMiner
Malwarebytes	Trojan.BitCoinMiner.Generic
Panda	Trj/Genetic.gen
Rising	Trojan.Obfus/Autoit!1.BD86 (CLASSIC)
Ikarus	Trojan.Win32.Autoit
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Generic!tr
AVG	FileRepMalware
Paloalto	generic.ml