About “Win32/Poison.NCL” infection

The Win32/Poison.NCL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Poison.NCL virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/Poison.NCL?


File Info:
name: 29CCC986A380AD6B6E12.mlw
path: /opt/CAPEv2/storage/binaries/6d012a6d6f5817f0a7da7c615334df53872cc693696463725c09cce5048fb1de
crc32: CAF5D4EC
md5: 29ccc986a380ad6b6e125f4d8fad5426
sha1: 65ca0484067c121ecb99c416070d15e7ad03b2e7
sha256: 6d012a6d6f5817f0a7da7c615334df53872cc693696463725c09cce5048fb1de
sha512: 954bdbc5f6c82a162a77cefc37e68c23986f94130f9116212f6096be0ab92665ab23dc12275bdc58c52f5d09fdc0a904c3c95376a5b58cbff76fd6c58a54c913
ssdeep: 1536:75neEhlcTW5sk1jtf2XvWINndIcN6JTfMgs5gfQtwSZPq39OK/RMOQqwubJ0:1nj9jtfU+INndIc0JjMJ5qQtwS4t9ZoL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T150936C1297D4813BF0F127B059FA12A31739BCE06F78A3AF924D15D95E726C0A57832B
sha3_384: c590b99e547615d381e068a510dec2119df68ff7df789b16024e415220134b2cbca5474612a66a93744c249eb3bfea3a
ep_bytes: e80a000000e97affffffcccccccccc8b
timestamp: 2004-08-04 06:01:37

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.2900.2180
Translation: 0x0409 0x04b0

Win32/Poison.NCL also known as:

Lionic	Trojan.Win32.Genome.4!c
Elastic	malicious (moderate confidence)
ClamAV	Win.Trojan.Bifrose-9463
Skyhigh	Generic VB.cd
McAfee	Artemis!29CCC986A380
Cylance	unsafe
Sangfor	Trojan.Win32.Poison.NCL
Alibaba	Trojan:Win32/Poison.36d40574
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.Generic.RFT
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Poison.NCL
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	Trojan.Win32.VB.ajzt
NANO-Antivirus	Trojan.Win32.VB.bkmwn
Avast	Win32:TrojanX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13bd476d
Sophos	Generic ML PUA (PUA)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.DownLoader4.53785
Jiangmin	Trojan/Chifrax.bgk
Webroot	W32.Trojan.Win32.Genome.Hfqw
Google	Detected
Avira	TR/Dropper.Gen
Kingsoft	malware.kb.a.1000
Xcitium	Malware@#1afxnohpakj55
ZoneAlarm	Trojan.Win32.VB.ajzt
Microsoft	Trojan:Win32/Provis!rts
Varist	W32/Backdoor.KSYV-8997
AhnLab-V3	Backdoor/Win.Bifrose.R537738
VBA32	Malware-Cryptor.VB.gen.1
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Bck/Hupigon.LMU
Rising	Trojan.Generic@AI.91 (RDMK:2/s+Ua3unVSuHgTX/hQDOA)
Ikarus	Trojan-Spy.Win32.QQPass
MaxSecure	Trojan.Malware.1087617.susgen
Fortinet	W32/Bifrose.BZR!tr.bdr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.4067c1
DeepInstinct	MALICIOUS

How to remove Win32/Poison.NCL?

Win32/Poison.NCL removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X