Win32/TrojanDownloader.Swizzor.NDI removal tips

The Win32/TrojanDownloader.Swizzor.NDI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Swizzor.NDI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Uses suspicious command line tools or Windows utilities
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/TrojanDownloader.Swizzor.NDI?

File Info:
name: A0103D89468753DA5FB8.mlw
path: /opt/CAPEv2/storage/binaries/1e98814ebba181a9ab6ac73b584f9430e8a0d3c244023e6b64442ee53db95c65
crc32: 58E9F66E
md5: a0103d89468753da5fb812c35a255a9d
sha1: 1919e380918208f59497c668c59cac29b59420b2
sha256: 1e98814ebba181a9ab6ac73b584f9430e8a0d3c244023e6b64442ee53db95c65
sha512: 5ee02446332bca4b4f4c1a1eb1f9b3a32a94d989e44de360f2d0fdfa14a3c2eeeaf67b9807cad1611454163716c0bdfb5ac70ad6f54dfa71908ceb9d6fd833ec
ssdeep: 12288:eVozuQHw8PAAsknHeg0OVZJ+kqEkfC+6vDhuicOOpv6XGBRd3J:eVoKow8PAAkpIJ+kqHa+akicOsv6XGBB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T140C40150F1C2C0B2C4569A372E9F9376F432BB909B73844B6BA86D5D7D303E188AB705
sha3_384: 6dbe273b365f4bcd074e9455b6ba7fdd816ad83603b7ce30561651d5c22a77bcf807ca7045507577482947dee3948c5a
ep_bytes: e8a922ffffe917feffff01da8b5a7c8b
timestamp: 2007-11-01 13:08:54

Version Info:
CompanyName: Ewept aidfeoe kuetipt
FileDescription: Eihrwvee etaiehsl hea wnvoehcg
FileVersion: 5, 4, 5, 5
InternalName: an
LegalCopyright: Nffn ohlieaor nwfni ece.
OriginalFilename: an.exe
ProductName: Eaahrwyl enift otnpeo
ProductVersion: 5, 4, 5, 5
Translation: 0x0409 0x0409

Win32/TrojanDownloader.Swizzor.NDI also known as:

How to remove Win32/TrojanDownloader.Swizzor.NDI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.