About “Win64/DriverReviver.A potentially unwanted” infection

The Win64/DriverReviver.A potentially unwanted is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win64/DriverReviver.A potentially unwanted virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Collects information about installed applications
• Attempts to modify proxy settings

How to determine Win64/DriverReviver.A potentially unwanted?

File Info:
name: 3213393C2410FBA3EEB2.mlw
path: /opt/CAPEv2/storage/binaries/a658bc02a4ce6e7d25c34e58d9772e8d0f98f1d7a0088ee22659f1a6b7c5ce3a
crc32: ED0AD94A
md5: 3213393c2410fba3eeb26f327bdf686f
sha1: 276170538098c2d045edfd4b620874004c0169a7
sha256: a658bc02a4ce6e7d25c34e58d9772e8d0f98f1d7a0088ee22659f1a6b7c5ce3a
sha512: db74e3677e0f2fac5577186f89052e7dda2ad8bab06ce9494f16af8831d8e034f271f3737471989e8138e3d4b50f6a9738cd4839cf36560ff34895c3b2ddd0e8
ssdeep: 98304:ZHywdzVOP3x9ISppjVaIqmmVk2hSst5/m7p56Jzz6H:ZHZdpqxhPjfsSsthm7P6pze
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14C36F199A118C48AE4370FFAB971FB3404721FA5E4D8115CA9B9331F29B3741B90BB67
sha3_384: c7646f3a4a7bf9a9c0305641d1ed6908451cbb6798b6034ca75c04f6fcede6ade5f9efbba711aad4c1d377f858db1b6f
ep_bytes: 81ecd4020000535556576a2033ed5e89
timestamp: 2010-04-10 12:19:38

Version Info:
CompanyName: ReviverSoft LLC
FileDescription: Driver Reviver
FileVersion: 5.3.2.16
LegalCopyright: Copyright (c) 2014 ReviverSoft LLC. All Rights Reserved.
ProductName: Driver Reviver
ProductVersion: 5.3.2.16
Translation: 0x0000 0x04b0

Win64/DriverReviver.A potentially unwanted also known as:

How to remove Win64/DriverReviver.A potentially unwanted?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.