Categories: Worm

How to remove “Worm:Win32/Stercogs.B”?

The Worm:Win32/Stercogs.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Stercogs.B virus can do?

HTTPS urls from behavior.
Reads data out of its own binary image
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes executed files from disk

How to determine Worm:Win32/Stercogs.B?


File Info:
name: 5CBDD2E2FD9F4F6021FB.mlwpath: /opt/CAPEv2/storage/binaries/f54472e7f6e02875f8278a8187c8a2facd77607f05be00f8ccb88afb2f8f2436crc32: 0F26EA50md5: 5cbdd2e2fd9f4f6021fb358123f7c81bsha1: 73521933f458a83160f67a503970d4c1cdb390f0sha256: f54472e7f6e02875f8278a8187c8a2facd77607f05be00f8ccb88afb2f8f2436sha512: 1e5c454a4d06b7f90f9d78cf3dcc22ee0781296374c7ce4526fad6d344c0aab58ce5844b9aa7cb36b1952106e6c3a3353d93ef7a966f0a538760babe46a000c9ssdeep: 1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OhG7mJAm/lGb3lls:SdV1Z1i3QKqhGCJr/lhtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T128939E127AE180B2C48541BC1A9C8F54AB7BBC1455BDD903EB544A8BEFF22D2D73E316sha3_384: ac5a10cf50df09ea53846bd3ccfbd1b4c0d697cb9f1322b02d54adf46203dfd02ab00189ae76681d9a994ebe80b5b5e4ep_bytes: 6a606830e34000e8dc0e0000bf940000timestamp: 2007-08-24 09:13:57
Version Info:
CompanyName: Microsoft CorporationFileDescription: Support connection to SharePoint Portal ServerFileVersion: 5.1.10InternalName: sppsvr.exeLegalCopyright: © Microsoft Corporation. All right reserved.OriginalFilename: sppsvr.exeProductName: Microsoft® Windows® Operating SystemProductVersion: 5.1.10Translation: 0x0409 0x04b0

Worm:Win32/Stercogs.B also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Mint.Zard.30
FireEye	Generic.mg.5cbdd2e2fd9f4f60
CAT-QuickHeal	Worm.Stercogs.B4
McAfee	GenericRXFF-JN!5CBDD2E2FD9F
Malwarebytes	Malware.AI.100878257
Zillya	Trojan.Agent.Win32.725
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	EmailWorm ( 005327141 )
K7GW	EmailWorm ( 005327141 )
Cybereason	malicious.2fd9f4
VirIT	Trojan.Win32.Agent.BJI
Cyren	W32/NewMalware-Rootkit-I-based!
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Stercogs.A
APEX	Malicious
ClamAV	Win.Trojan.Agent-182755
Kaspersky	Trojan.Win32.Agent.aqhn
BitDefender	Gen:Heur.Mint.Zard.30
NANO-Antivirus	Trojan.Win32.Agent.lyzr
SUPERAntiSpyware	Trojan.Agent/Gen-Crypt
Avast	Win32:Adware-gen [Adw]
Tencent	Trojan.Win32.Agent.zaa
TACHYON	Trojan/W32.Agent.96256.Q
Sophos	W32/Stercogs-A
F-Secure	Trojan.TR/Crypt.XPACK.Gen3
DrWeb	Adware.Baidu.391
VIPRE	Gen:Heur.Mint.Zard.30
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Emsisoft	Gen:Heur.Mint.Zard.30 (B)
Ikarus	Trojan.Crypt
GData	Gen:Heur.Mint.Zard.30
Jiangmin	Trojan/Agent.ckli
Avira	TR/Crypt.XPACK.Gen3
Antiy-AVL	Trojan/Win32.Agent
Arcabit	Trojan.Mint.Zard.30
ViRobot	Trojan.Win32.Agent.96256.R
ZoneAlarm	Trojan.Win32.Agent.aqhn
Microsoft	Worm:Win32/Stercogs.B
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Downloader.R5522
BitDefenderTheta	AI:Packer.E15472C01F
MAX	malware (ai score=88)
VBA32	Trojan.Agent
Cylance	unsafe
Panda	Generic Malware
Rising	Trojan.Win32.Agent.gsm (CLASSIC)
Yandex	Trojan.GenAsa!eJ/Hvs8WfCY
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.W32.Agent.aqhn
Fortinet	W32/Agent.GOO!tr.dldr
AVG	Win32:Adware-gen [Adw]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)