Trojan

Win32/TrojanClicker.VB.OEM removal guide

Malware Removal

The Win32/TrojanClicker.VB.OEM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/TrojanClicker.VB.OEM virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (6 unique times)
  • Reads data out of its own binary image
  • Performs some HTTP requests
  • Sniffs keystrokes
  • Steals private information from local Internet browsers
  • Installs itself for autorun at Windows startup
  • Attempts to modify browser security settings
  • Attempts to modify UAC prompt behavior
  • Anomalous binary characteristics

Related domains:

ocsp.pki.goog
www.gstatic.com
fonts.gstatic.com
playboy365.net
g2.symcb.com
vassg142.ocsp.omniroot.com

How to determine Win32/TrojanClicker.VB.OEM?


File Info:

crc32: 47EEBFC2
md5: 16bae5afad01a2b90078c04b1b87c378
name: 16BAE5AFAD01A2B90078C04B1B87C378.mlw
sha1: e79c8f491ba8ea6a847d2f81ad6e0549b4984c21
sha256: 2cf2765e989ce0639ae1e29f712d80f4d16e0063d5a36ff404a93c5274187ddb
sha512: 1f800dbd46531cb3339dd935a1d49ddb7f96a29bdfb123c5af552e756667d63ed9cfa60d184e77d3efbf4c39c8a205cf1ad75a4d66cc79f697eedd3f214110c1
ssdeep: 6144:cd/+lA+8x6P7IASzAIEG7Dt5KND2bO6ZjQI1XcvXAvSHe03:wmlA+8x6P7IASzAIEG7Dt5KND2bO6Zj
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0
InternalName: Project1
FileVersion: 1.00
CompanyName: CloudFlare LTD
ProductName: Project1
ProductVersion: 1.00
OriginalFilename: Project1.exe

Win32/TrojanClicker.VB.OEM also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Multi.Generic.4!c
CylanceUnsafe
ZillyaTrojan.VB.Win32.153954
SangforTrojan.Win32.Clicker-VB.8
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/TrojanClicker.VB.OEM
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Malware.Generic-9835979-0
KasperskyUDS:DangerousObject.Multi.Generic
NANO-AntivirusTrojan.Win32.Kazy.czqozq
SophosML/PE-A
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Fareit.dt
FireEyeGeneric.mg.16bae5afad01a2b9
SentinelOneStatic AI – Suspicious PE
AviraTR/Kazy.384196
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.A2748A
MicrosoftTrojan:Win32/Wacatac.B!ml
ZoneAlarmUDS:DangerousObject.Multi.Generic
McAfeeArtemis!16BAE5AFAD01
YandexTrojan.Kazy!BhamGBYHtqo
IkarusTrojan-Downloader.Win32.Bancos
FortinetW32/TrojanClicker_VB.OEM!tr
AVGWin32:Malware-gen

How to remove Win32/TrojanClicker.VB.OEM?

Win32/TrojanClicker.VB.OEM removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment