Win32.Pioneer.C removal guide

The Win32.Pioneer.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32.Pioneer.C virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32.Pioneer.C?


File Info:
name: 54A78D93C66561AE11E5.mlw
path: /opt/CAPEv2/storage/binaries/ec06908ecba69d32a8f5b4c7dd3600db1d3187ad093668ad817ae92888cfd296
crc32: DD794AF6
md5: 54a78d93c66561ae11e5388a0bb930bf
sha1: d1041c8835562e56d2c4f4143ba27bc8b35b3ded
sha256: ec06908ecba69d32a8f5b4c7dd3600db1d3187ad093668ad817ae92888cfd296
sha512: fa82ac991f5e179c3fc73b3def4bae9f8756f2e6215ac76951b46db91d3d1b0fdf1aa402c295f2c3bcd4f04d85cdb7f70b319559dba61a662171b274a519d85c
ssdeep: 384:B+107NY8MPTIaW7/l9lNgRdJSW781gW/xyCdz9e6F:7pITIaWh9gn+1dxbz9n
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17E826D1B96446432E4F2003011BAA51A6B6DAB71B7608DD37345365B9F767C3DEF830B
sha3_384: 3f7603ad46224d14d17f73cbbd75da10633a405aa26b75ada885e93150536c1ec63d395ee231fb93605d6897c57dc50a
ep_bytes: 60e8000000005d81ed10a54000eb05e9
timestamp: 2004-08-04 06:02:34

Version Info:
CompanyName: Microsoft Corporation
FileDescription: CTF Loader
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: CTFMON
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: CTFMON.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.2180
OleSelfRegister: 
Translation: 0x0409 0x04b0

Win32.Pioneer.C also known as:

MicroWorld-eScan	Win32.Pioneer.C
CAT-QuickHeal	W32.Agent.CF
McAfee	Generic Malware.dp
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
Cybereason	malicious.3c6656
BitDefenderTheta	AI:FileInfector.B57466090F
Cyren	W32/Pioneer.A.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Silly.NAB
Zoner	Probably Heur.ExeHeaderL
APEX	Malicious
Cynet	Malicious (score: 99)
BitDefender	Win32.Pioneer.C
NANO-Antivirus	Trojan.Win32.Suspic.bbpkbf
Avast	Win32:Patched-GF [Trj]
Emsisoft	Win32.Pioneer.C (B)
F-Secure	Heuristic.HEUR/AGEN.1334712
DrWeb	Trojan.Starter.1075
VIPRE	Win32.Pioneer.C
TrendMicro	PE_LUDER.AI
McAfee-GW-Edition	BehavesLike.Win32.Virut.lm
FireEye	Win32.Pioneer.C
Ikarus	Virus.Win32.Hezhi
Webroot	W32.malware.Gen
Avira	HEUR/AGEN.1334712
Microsoft	Trojan:Win32/Wacatac.B!ml
Xcitium	Virus.Win32.Pioneer.C0@1ij8ar
Arcabit	Win32.Pioneer.C
ViRobot	Win32.Pioneer.A
GData	Win32.Pioneer.C
Google	Detected
AhnLab-V3	Win32/Fload.Gen
VBA32	Virus.Expiro.d
ALYac	Win32.Pioneer.C
MAX	malware (ai score=80)
Malwarebytes	Malware.AI.2478817681
Panda	Generic Suspicious
TrendMicro-HouseCall	PE_LUDER.AI
Rising	Win32.Agent.dn (CLASSIC)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Virus.W32.Patched.MP
Fortinet	PossibleThreat
AVG	Win32:Patched-GF [Trj]
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Win32.Pioneer.C?

Win32.Pioneer.C removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X