Categories: Malware

Win32/PSW.Gamania.NFI removal tips

The Win32/PSW.Gamania.NFI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/PSW.Gamania.NFI virus can do?

Injection with CreateRemoteThread in a remote process
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
The binary likely contains encrypted or compressed data.
Code injection with CreateRemoteThread in a remote process
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

www.supotbbs.com

How to determine Win32/PSW.Gamania.NFI?


File Info:
crc32: AA238499md5: 6dc5486efdd23ed83963fca0e101e33dname: 6DC5486EFDD23ED83963FCA0E101E33D.mlwsha1: e45173f46909c9610c0ac435bbd065e48f057b82sha256: 3a4043caec50e143b3d55c637099fdb71fc31764da1f8e421ca211f2e9fd431bsha512: c81312ee7eba71ab41d65c03ba56da34aa21e56c0895b21c214df1b7859eb63c5993a6411ff557ff34844a49e3e7d1133e72ba61582879c4214b61ca3d520621ssdeep: 1536:tQnLyzd0/cinRCmbkTdz/fTAG2tySXA4LU:7dScinpbEfT6QEUtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Win32/PSW.Gamania.NFI also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Riskware ( 0015e4f11 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen.7986
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.UT.dmX@aeLJ6Bf
Cylance	Unsafe
Zillya	Trojan.Pincav.Win32.11117
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	TrojanPSW:Win32/Pincav.4ddfe506
K7GW	Riskware ( 0015e4f11 )
Cybereason	malicious.efdd23
Cyren	W32/Risk.CBBE-2939
Symantec	W32.Gammima.AG
ESET-NOD32	a variant of Win32/PSW.Gamania.NFI
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	Trojan.Win32.Pincav.ageu
BitDefender	Gen:Trojan.Heur.UT.dmX@aeLJ6Bf
NANO-Antivirus	Trojan.Win32.Pincav.bxyca
ViRobot	Trojan.Win32.Pincav.54272.C
MicroWorld-eScan	Gen:Trojan.Heur.UT.dmX@aeLJ6Bf
Tencent	Win32.Trojan.Pincav.bpov
Ad-Aware	Gen:Trojan.Heur.UT.dmX@aeLJ6Bf
Sophos	ML/PE-A + Mal/Dorf-F
Comodo	Malware@#qkwhvio925j3
BitDefenderTheta	AI:Packer.E63689A01E
VIPRE	Trojan-GameThief.Win32.Magania.egen (v)
TrendMicro	TROJ_PINCAV.SMXA
McAfee-GW-Edition	BehavesLike.Win32.VirRansom.qc
FireEye	Generic.mg.6dc5486efdd23ed8
Emsisoft	Gen:Trojan.Heur.UT.dmX@aeLJ6Bf (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Invader.xy
Webroot	W32.Malware.Gen
Avira	TR/Crypt.ZPACK.Gen
eGambit	Generic.PSW
Antiy-AVL	Trojan/Generic.ASMalwS.EC6959
Microsoft	PWS:Win32/Magania.gen
ZoneAlarm	Trojan.Win32.Pincav.ageu
GData	Gen:Trojan.Heur.UT.dmX@aeLJ6Bf
TACHYON	Trojan/W32.Pincav.54272.Q
AhnLab-V3	Trojan/Win32.OnlineGameHack.R959
McAfee	Artemis!6DC5486EFDD2
MAX	malware (ai score=98)
VBA32	BScope.TrojanPSW.Gamania
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_PINCAV.SMXA
Rising	Trojan.Generic@ML.100 (RDML:x3d+04aZZkb+rVUHJyNDmQ)
Yandex	Trojan.GenAsa!bG/DMFCfHsc
Ikarus	Trojan.Win32.Pincav
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Pakecav.P!tr
AVG	Win32:PWSX-gen [Trj]
Qihoo-360	Win32/TrojanSpy.Magania.HxMBEpsA