Should I remove “Worm:Win32/Pykspa.D”?

The Worm:Win32/Pykspa.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Pykspa.D virus can do?

• Attempts to connect to a dead IP:Port (2 unique times)
• Possible date expiration check, exits too soon after checking local time
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Sniffs keystrokes
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Anomalous binary characteristics

How to determine Worm:Win32/Pykspa.D?

File Info:
name: DA38C4448BA061186B96.mlw
path: /opt/CAPEv2/storage/binaries/f81e6fefc0edd22d9e0dc40b83a788df965610013df528e88db9b6da48da53d9
crc32: 8F95F91E
md5: da38c4448ba061186b96b02834f18f8c
sha1: 7c2327f6d7e673c0c5f6fa9b804ba36612012755
sha256: f81e6fefc0edd22d9e0dc40b83a788df965610013df528e88db9b6da48da53d9
sha512: e4477cecf4362d70dcdb0f44fa9a0ad1f86ed9b65349aef577d2349aaff6fc40b026a29d84611968e39e3e9e5ea9431d61bd371f291e0a1411eeca0c4f5c955d
ssdeep: 1536:MYjxvZtefzgSFXf2rr3hR9AuyEq7lERyKqoIYJ:zBefzgSRK3hLHyEmlboV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T132836E70A6640D7EDF1756FD604E94EE66DEDEA212C6002A37F192C28B20798C45EE2C
sha3_384: 8dedd2cdc9ecbf31463ba49caeb7ec7362f333180afe4fd1b775a1e3de65c4b9943c375e4451d6a06ac21d1d5aed5b1f
ep_bytes: 558bec81ec18010000c785ecfeffff68
timestamp: 2008-02-03 16:22:15

Version Info:
0: [No Data]

Worm:Win32/Pykspa.D also known as:

How to remove Worm:Win32/Pykspa.D?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.