Win32/TrojanDownloader.Swizzor.NFR removal instruction

The Win32/TrojanDownloader.Swizzor.NFR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Swizzor.NFR virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempted to write directly to a physical drive
• Attempts to modify proxy settings
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/TrojanDownloader.Swizzor.NFR?

File Info:
name: F32B2FF326F617FCE475.mlw
path: /opt/CAPEv2/storage/binaries/104be6b2328dbf97e6f60e02501bed68647c1a5dbf89591f1b80ad4e4a8d2669
crc32: B00A5779
md5: f32b2ff326f617fce4758d8cfc15cded
sha1: efe06988c84cd07e6b1197ad605cdbaa1e0aa6f1
sha256: 104be6b2328dbf97e6f60e02501bed68647c1a5dbf89591f1b80ad4e4a8d2669
sha512: 3fe5c25d4ee008de3088cb55034b4f2a233d46f273e8c8bc7e9765655d8654b6155af26d9aceb0a8c6761f49ff66a1a3647cca0c6debc45df2a5ce2c601e882d
ssdeep: 6144:docrmHFxEHFXM4vBsAQjbbV9XjSmdmqtTqOYbgsYc:docrmHnEHFXhvBlIbV5jSmdmq0bgsYc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T159741747A28A646BFC5251334BBE7AF980EC6C3535948D334A646EF726AC140DCDA3C7
sha3_384: cd209d2252105ece171b5568ee710e98f88a4cdcbac9b0dd3eee515d397bc5bdc5b1be1004825349ec953da5d478a350
ep_bytes: 6a606830504300e8e064ffffbf940000
timestamp: 2007-10-10 17:30:32

Version Info:
CompanyName: Thrwiool icesaial
FileDescription: Ybkwt gmtish eee gsefose
FileVersion: 7, 1, 3, 0
InternalName: de
LegalCopyright: Olna tarhifnh aosan ktel tcsla ihodagb!
OriginalFilename: de.exe
ProductName: Reec madyms aotnaed
ProductVersion: 5, 0, 1, 5
Translation: 0x0409 0x0409

Win32/TrojanDownloader.Swizzor.NFR also known as:

How to remove Win32/TrojanDownloader.Swizzor.NFR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.