Malware

Win32/Packed.Themida.DTW removal tips

Malware Removal

The Win32/Packed.Themida.DTW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Packed.Themida.DTW virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Checks for the presence of known windows from debuggers and forensic tools
  • The following process appear to have been packed with Themida: intervpnmix2.exe
  • Writes a potential ransom message to disk
  • Checks for the presence of known devices from debuggers and forensic tools
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

iplogger.org
jload09.info

How to determine Win32/Packed.Themida.DTW?


File Info:

crc32: FC454CF7
md5: f34b87dc8ae879c4903667db0a36ae35
name: intervpnmix2.exe
sha1: f73c86bf207f5e3be53e9e1c1d244ab97641514d
sha256: b6b664182ffd1cc29ddc3b74d184be519a38e047d5e5167fef7c893f7c5f1c5e
sha512: a2c1d37562e8d871001c81f8aaac5149b6b03dcd88b7e3124858a547843004fab9b58571f32cbe6c6e501ab9f6fda94aff7c1da021c505d8be57339bd850f308
ssdeep: 196608:r5G3oFXzSHflKvlz/1tcko57xBTJu7sbs7s6Q3h9wF9T8tnSmgm:rA3oFXzGflK9z17stlS89yTghgm
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Inter VPN SOFT Inc.
ProductVersion: 2.2.1.0
FileVersion: 2.2.1.0
FileDescription:
Translation: 0x0000 0x04b0

Win32/Packed.Themida.DTW also known as:

DrWebProgram.Unwanted.2892
MicroWorld-eScanTrojan.GenericKD.33540128
McAfeeArtemis!F34B87DC8AE8
MalwarebytesTrojan.Downloader.AHK.Themida
AegisLabTrojan.Win32.Generic.4!c
SangforMalware
K7AntiVirusTrojan ( 005449e81 )
BitDefenderTrojan.GenericKD.33540128
K7GWTrojan ( 005449e81 )
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Malware.Stralo-7590910-0
GDataWin32.Trojan.Ilgergop.RKEY92
KasperskyTrojan-PSW.Win32.Coins.vri
AlibabaTrojanPSW:Win32/Coins.db1a24dd
TencentWin32.Trojan-qqpass.Qqrob.Eawp
Endgamemalicious (high confidence)
EmsisoftTrojan.GenericKD.33540128 (B)
F-SecureHeuristic.HEUR/AGEN.1038489
TrendMicroTROJ_GEN.R002C0WCE20
McAfee-GW-EditionBehavesLike.Win32.Dropper.rc
SophosMal/Generic-S
CyrenW32/Trojan.GJLU-4456
eGambitUnsafe.AI_Score_99%
AviraTR/PSW.Coins.qciqd
MAXmalware (ai score=81)
MicrosoftTrojan:Win32/Vigorf.A
ArcabitTrojan.Generic.D1FFC820
ZoneAlarmHEUR:Trojan-Downloader.Win32.Stralo.gen
AhnLab-V3Malware/Win32.Generic.C3539287
Acronissuspicious
ALYacTrojan.GenericKD.33540128
Ad-AwareTrojan.GenericKD.33540128
CylanceUnsafe
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Packed.Themida.DTW
TrendMicro-HouseCallTROJ_GEN.R002C0WCE20
RisingTrojan.Generic@ML.100 (RDML:VesfO5wDZnj7y64zck97Gw)
YandexRiskware.Unwanted!
IkarusTrojan-Downloader.Win32.Autohk
FortinetW32/Generic!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
Qihoo-360Generic/HEUR/QVM42.3.D91F.Malware.Gen

How to remove Win32/Packed.Themida.DTW?

Win32/Packed.Themida.DTW removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment