About “Win32/TrojanDownloader.Swizzor.NFP” infection

The Win32/TrojanDownloader.Swizzor.NFP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Swizzor.NFP virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• Attempts to modify proxy settings
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Touches a file containing cookies, possibly for information gathering
• Uses suspicious command line tools or Windows utilities
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/TrojanDownloader.Swizzor.NFP?

File Info:
name: 2065D508B697AAEFF730.mlw
path: /opt/CAPEv2/storage/binaries/ee316244e6f68d1237fcf04eb472ed91b49a02b482585de0e511a32c1ee0484a
crc32: 612021AA
md5: 2065d508b697aaeff7303ceea50f5218
sha1: fb8f1a2684e44fc6b9d0bdbae0b78654933d835f
sha256: ee316244e6f68d1237fcf04eb472ed91b49a02b482585de0e511a32c1ee0484a
sha512: e15cbc96138c79d454d912f336cf4d776e816826df101ea7656cacb7d8af4d06abf2ebd3aaf4423206b0c82a39c4cd7d6f8e0667c40c27831b391eda01333454
ssdeep: 12288:rX8WkX+RURn0ZtbGLxs73IDqQwaLYogrYr6RTNKm5tvbncr+FhLgSJ:rXpG+RUR07osLIu8LYL0roTN9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C7C4BF91D6BEA075C652FCF0A0E69B56B4535D40F0129882FF78FE6A7E31B8213F9205
sha3_384: 71c301dc79e6eb22c9ccca42ddd2fb619a09812ab38cb56777169abe4f0cdbfadcb6b1c0eaf6bf4f05c1a0532992a744
ep_bytes: 6a6068b02c4500e8df030200bf940000
timestamp: 2007-09-14 12:06:07

Version Info:
CompanyName: Linderse
FileDescription: Sedadere at dwomalc ouchi
FileVersion: 3, 3, 2, 4
InternalName: S
LegalCopyright: Soratofi ter sponome.
OriginalFilename: S.exe
ProductName: Ntind
ProductVersion: 5, 2, 3, 1
Translation: 0x0409 0x0409

Win32/TrojanDownloader.Swizzor.NFP also known as:

How to remove Win32/TrojanDownloader.Swizzor.NFP?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.