How to remove “Win32/Pronny.BM”?

The Win32/Pronny.BM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Pronny.BM virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Pronny.BM?

File Info:
name: 605D1700EE9FCFB5B53B.mlw
path: /opt/CAPEv2/storage/binaries/5b99dca1a580a811e68676bf70b0f7e50d2458b44c0369155866c14c318a1650
crc32: 0064BDE7
md5: 605d1700ee9fcfb5b53b4a0829ad99a3
sha1: a48ce3aaf85634afd93caa172826fffaacdc27e7
sha256: 5b99dca1a580a811e68676bf70b0f7e50d2458b44c0369155866c14c318a1650
sha512: 1321eb685c5dd56fe2f6e66811a8a65590894d75a3199a5f4a324fff1a8a48e8a7b7056bbbf4fb9c05fa1b357a3125c9645764dd9be90dc79fdc79765ea0f6a3
ssdeep: 1536:D2IEc5HBkoNhTOWhcPYZxAxMpBd48CArrprLP2:CIDHNhTOWhcAZxAulV2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12283A65B7F40C069E725697C27FAC3E215E7689E5A0B154BB6003F694CDBF240A18EB3
sha3_384: 88843b88ea8713064ff2514c0aa8265fcc8b46a042a35ddc7202630f9ccc9c0428cd3f2e0abc4eb6238620a10a660397
ep_bytes: 6870124000e8f0ffffff000000000000
timestamp: 2012-07-18 20:04:49

Version Info:
Translation: 0x0409 0x04b0
Comments: taslet dinergate
CompanyName: taslet dinergate
FileDescription: taslet dinergate
LegalCopyright: taslet dinergate
LegalTrademarks: taslet dinergate
ProductName: taslet dinergate
FileVersion: 1.48
ProductVersion: 1.48
InternalName: forespeed
OriginalFilename: forespeed.exe

Win32/Pronny.BM also known as:

How to remove Win32/Pronny.BM?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.