Categories: Malware

Win32/PSW.QQPass.NJE removal instruction

The Win32/PSW.QQPass.NJE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/PSW.QQPass.NJE virus can do?

Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The executable is likely packed with VMProtect
Authenticode signature is invalid
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/PSW.QQPass.NJE?


File Info:
name: F72209F3B5C7E28B7F93.mlwpath: /opt/CAPEv2/storage/binaries/ac39813a20f0a6ca6abd0a7496068a30f19eeb296b3e8e1adccf9b1bfd1a1e0dcrc32: B55626EBmd5: f72209f3b5c7e28b7f93f8fac296705csha1: 9f086f6dc2513a5956e9d842e93ae3e4b540c111sha256: ac39813a20f0a6ca6abd0a7496068a30f19eeb296b3e8e1adccf9b1bfd1a1e0dsha512: 131981d4cea2143f5fa361107f2995c0ef953c94a6c112a0e8b1f7fe8b039bbe07b2083ed5d019bd0418366146f840c43a6153506f80ab074c6a040bbeb00315ssdeep: 12288:Wb/m4QTq7OPwAEuJrqXbZdQr6SCsju3ySFigW/B:WCHwAprWVdM6vsEnW/Btype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1385610817582B2C6F3C0BBBBCDA1939972F0D55241DC0059670EA2BBFD75B5BAB2D420sha3_384: b0e23c0b6d931e5f3944b24c3f50af85bdddc305d212ca82385430c51c038d6db0bbc22372109f2a9d8e900f7868119bep_bytes: 68cf42be04e869540000000077617665timestamp: 2011-06-07 14:52:08
Version Info:
CompanyName: Kingsoft CorporationFileDescription: 金山卫士主程序FileVersion: 3.0.1.1518InternalName: KSafeLegalCopyright: Copyright (C) 1998-2011 Kingsoft CorporationOriginalFilename: KSafe.exeProductName: 金山卫士ProductVersion: 3.0.1.1518Translation: 0x0000 0x04b0

Win32/PSW.QQPass.NJE also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.GenericKD.69944377
FireEye	Generic.mg.f72209f3b5c7e28b
Skyhigh	BehavesLike.Win32.Generic.tm
McAfee	Artemis!F72209F3B5C7
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.GenericKD.69944377
Sangfor	Infostealer.Win32.QQPass.Vli2
K7AntiVirus	Trojan ( 005acd481 )
Alibaba	TrojanPSW:Win32/QQPass.34548edf
K7GW	Trojan ( 005acd481 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D42B4439
VirIT	Trojan.Win32.Generic.CFBD
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/PSW.QQPass.NJE
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:Trojan.Win32.Hesv.gen
BitDefender	Trojan.GenericKD.69944377
Avast	Win32:Evo-gen [Trj]
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.PWS.Qq.10
Zillya	Trojan.QQPass.Win32.64961
Trapmine	suspicious.low.ml.score
Emsisoft	Trojan.GenericKD.69944377 (B)
SentinelOne	Static AI – Malicious PE
Varist	W32/SuspPack.BQ.gen!Eldorado
Antiy-AVL	Trojan/Win32.FlyStudio.a
Xcitium	TrojWare.Win32.Agent.OSCF@5rs7jr
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Trojan.Win32.Hesv.gen
GData	Win32.Trojan.PSE.15IBL0F
Google	Detected
AhnLab-V3	Trojan/Win32.QQPass.R21404
BitDefenderTheta	Gen:NN.ZexaF.36792.@J0@aacM!mlb
ALYac	Trojan.GenericKD.69944377
MAX	malware (ai score=89)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CJQ23
Rising	Stealer.QQPass!1.648F (CLASSIC)
Ikarus	Trojan-PWS.Win32.QQPass
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/QQPass.NJE!tr.pws
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.dc2513
DeepInstinct	MALICIOUS