Win32/TrojanDownloader.FlyStudio.CP information

The Win32/TrojanDownloader.FlyStudio.CP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.FlyStudio.CP virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Executable file is packed/obfuscated with MPRESS
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Attempts to modify proxy settings
• Uses suspicious command line tools or Windows utilities

How to determine Win32/TrojanDownloader.FlyStudio.CP?

File Info:
name: 3D189D1998CE8AB766F7.mlw
path: /opt/CAPEv2/storage/binaries/a75053eb0d5ff976c8ce60aa2f0bcac9c1cb6ab3e59d5967c5389bdee3e826f4
crc32: 356C943B
md5: 3d189d1998ce8ab766f70bf98145ce8c
sha1: 0402fa1723d54761887095909d66201ab4a77d70
sha256: a75053eb0d5ff976c8ce60aa2f0bcac9c1cb6ab3e59d5967c5389bdee3e826f4
sha512: 75d4e7519ee058f121880b839bf40a0543c6314158895c6411bc10adffbb85224197f1ae192537ec1e2cd11a6c8f2ba2b198e67434089432e41ac1d24ec90101
ssdeep: 6144:plLwgE6JPJi9RoL9ZrfrVhP00qjZxdqok4okp/3Bnb:pdwGhZ/oP7SA3Bb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11484125AD2F4EA1DD3570039FC8507A0FC80199657A21A3B4A006EC9FC9BF77FA69354
sha3_384: 92fe9bab81dd11c0b39cae0a6b037800b991fffe8c80d47483fd6962a13e929101640342552a4f5a880608a208d601ad
ep_bytes: 60e80000000058059e0200008b3003f0
timestamp: 2015-03-26 04:25:14

Version Info:
FileVersion: 1.0.0.0
FileDescription: windows自动应用程序
ProductName: uninstaller
ProductVersion: 1.0.0.0
LegalCopyright: windows卸载程序 请24小时自行删除
Comments: windows卸载删除程序
Translation: 0x0804 0x04b0

Win32/TrojanDownloader.FlyStudio.CP also known as:

How to remove Win32/TrojanDownloader.FlyStudio.CP?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.