About “Win32/RiskWare.PrefChanger.B” infection

The Win32/RiskWare.PrefChanger.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/RiskWare.PrefChanger.B virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine Win32/RiskWare.PrefChanger.B?

File Info:
name: 9893393E43EF80DCA11F.mlw
path: /opt/CAPEv2/storage/binaries/55f655d6bf962b4a6d3822c457ee87bf41d23b44e38c236b578d8acfdec58325
crc32: 52930DC5
md5: 9893393e43ef80dca11f74ad6271e5a3
sha1: 18a3a741bad70d6750d5ac6b637c62dc51f9f045
sha256: 55f655d6bf962b4a6d3822c457ee87bf41d23b44e38c236b578d8acfdec58325
sha512: c57dedc33cb0a87f827c611caba5ddf4a28367a409684b097003c035ca6d22c523ab872a1ff1c6d9eb9f0103fcb42d74c36f72885e9c9b88944d22ac347519ab
ssdeep: 98304:2tMcx5F1mf5+aStJrEdd3rKAreqk+1Y/JmIBoblpb47fR6Kt2KV9slLXMR:2tMcxHG5atJ2ZTw+6BwpbbKLDslYR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16F46331AFEE199F1CB18473A1ABA9E3E9C1F1382533644B7E74E5E1980A4B1F4F04176
sha3_384: d96bbcd790a6a540789fa07ede10031b7986b744ba7a30cd4f1d021b3c90cf694981bc2809349a412c6a584be13e911d
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-06-18 21:33:23

Version Info:
Comments: Turtle Girl
CompanyName: Shmehao Network Co., Ltd.
Contact: Shmehao Network Co., Ltd.
FileDescription: Turtle Girl Setup
FileVersion: 1.0.0.1
LegalCopyright: Copyright (C) 2014 Shmehao.com. All Rights Reserved.
LegalTrademarks: Turtle Girl
OriginalFilename: Turtle Girl.exe
ProductName: Turtle Girl
ProductVersion: 1.0.0.1
Translation: 0x0804 0x04e4

Win32/RiskWare.PrefChanger.B also known as:

How to remove Win32/RiskWare.PrefChanger.B?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.