What is “Win32:Patched-AWW [Trj]”?

The Win32:Patched-AWW [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Patched-AWW [Trj] virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32:Patched-AWW [Trj]?

File Info:
name: 0CA7C19302E35A325842.mlw
path: /opt/CAPEv2/storage/binaries/b75217fefe0f8407bcb87b3b1f5f3d3d6f3db941de5b7b6251b8671ac84309c7
crc32: 36B95C13
md5: 0ca7c19302e35a325842a3102b93d256
sha1: 36ad8d1f8d9941ef5b09749d1cd4b910e8fd411d
sha256: b75217fefe0f8407bcb87b3b1f5f3d3d6f3db941de5b7b6251b8671ac84309c7
sha512: b16f4be23e23351b0f87a0cc3259817ab2d6a71af2ff24bde995b4eb75bd9a61d7e472459a2260d5220646a769673551fd3360dd2c4c8f2495d1f1fa7a65d0d3
ssdeep: 12288:5KN+LSp4WTRW8fdethRQsIMPUoim21s6xiiAt:IN+upjTRW8fdetQlMsI2TxiiA
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T130D4D011E746C5B6C9AA04314E6F971DC0BDA8704F3296D3E3DD6B0E5EB02E2E932791
sha3_384: df16b4ba36ae22ea5f4f13c3f11dd3c6edd767c42eb1d0223e75a23f0e30755bc6d82f33075f9899e6db18bf22fd0cdc
ep_bytes: e86515ffffe991feffffccff25f0a343
timestamp: 2016-10-28 12:18:17

Version Info:
CompanyName: Adobe Systems Incorporated
FileDescription: LogTransport Application
FileVersion: 7.1.1.3403
InternalName: LogTransport2
LegalCopyright: Copyright 2008-15 Adobe Systems Incorporated. All rights reserved.
OriginalFilename: LogTransport2.exe
PrivateBuild: 7.1.1.3403
ProductName:  LogTransport Application
ProductVersion: 7.1.1.3403
Translation: 0x0409 0x04b0

Win32:Patched-AWW [Trj] also known as:

How to remove Win32:Patched-AWW [Trj]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.