Trojan:Win64/Necurs.A
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 466 |
| First Seen: | November 12, 2012 |
| Last Seen: | March 30, 2025 |
| OS(es) Affected: | Windows |
The detection of Trojan:Win64/Necurs.A on your system indicates a potential security threat that requires immediate attention. This report aims to provide you with a comprehensive understanding of the threat, its operational mechanisms, symptoms of infection, and most importantly, guidance on how to remove it from your computer.
Table of Contents
What Is Trojan:Win64/Necurs.A?
Trojan:Win64/Necurs.A is identified as a Trojan-type threat, which means it is a type of malware that disguises itself as legitimate software to gain unauthorized access to a computer system. The name itself suggests it is a Trojan horse malware targeting 64-bit Windows systems, but without more specific information, it's crucial to understand the general behavior of such threats to effectively combat them.
How Trojan:Win64/Necurs.A Operates
Trojan horses like Trojan:Win64/Necurs.A typically operate by deceiving users into installing them on their systems. Once installed, they can perform a variety of malicious actions, including but not limited to, stealing sensitive information, installing additional malware, and providing unauthorized access to the attackers. These threats often exploit vulnerabilities in software or use social engineering tactics to trick users into executing them.
Symptoms of Infection
Identifying a Trojan infection can be challenging because these threats are designed to remain stealthy. However, some common symptoms may include unusual system behavior, such as unexpected pop-ups, slow system performance, and unfamiliar programs or icons on your desktop. Additionally, you might notice changes in your browser settings or the presence of unwanted toolbars. It's essential to be vigilant and monitor your system's behavior regularly to catch any potential threats early.
- Unexplained changes in system settings or performance.
- Appearance of unfamiliar programs or files.
- Increased network activity without apparent reason.
- Frequent system crashes or freezes.
How to Remove Trojan:Win64/Necurs.A
- Enter Safe Mode with Networking: This will limit the malware's ability to interfere with the removal process. Restart your computer, and as it boots up, press the F8 key repeatedly until you see the Advanced Boot Options window. Select Safe Mode with Networking and proceed to the next step.
- Perform a Full Scan with a Reputable Tool: Utilize a trusted anti-malware program, such as SpyHunter, to scan your system thoroughly. Ensure your anti-malware software is updated with the latest definitions before starting the scan.
- Uninstall Suspicious Programs: Go through your installed programs and uninstall any that you do not recognize or that were installed around the time you suspect the infection occurred.
- Reset Your Browsers: For Chrome, Firefox, and Edge, reset the browsers to their default settings. This can usually be done from the browser's settings menu and is an effective way to remove any malicious extensions or changes made by the Trojan.
- Reboot and Re-scan: After completing the above steps, restart your computer in normal mode and perform another full scan with your anti-malware tool to ensure all traces of the threat have been removed.
Conclusion
Removing Trojan:Win64/Necurs.A from your system requires careful and systematic steps to ensure all components of the malware are eliminated. It's crucial to stay informed about the latest threats and to maintain a proactive approach to system security, including keeping your software up-to-date, being cautious with email attachments and downloads, and regularly scanning your system for malware. By following the guidance provided and maintaining vigilance, you can significantly reduce the risk of future infections and protect your sensitive information.
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| Panda | Generic Trojan |
| K7AntiVirus | Trojan |
| CAT-QuickHeal | Trojan.Comitproc.A |
| TrendMicro | TROJ_GEN.R2EC7HS |
| BitDefender | Trojan.Generic.7688049 |
| CAT-QuickHeal | Trojan.Necurs.a |
| AVG | Generic4.MKS |
| AhnLab-V3 | Adware/Win32.Agent |
| AntiVir | ADSPY/Agent.294912.1 |
| BitDefender | Adware.Generic.100294 |
| Kaspersky | not-a-virus:AdWare.Win32.Agent.pio |
| Symantec | Adware.Gen |
| F-Prot | W32/Adware.ACMR |
| CAT-QuickHeal | AdWare.Agent.pio (Not a Virus) |
| Panda | Trj/Necurs.A |
SpyHunter Detects & Remove Trojan:Win64/Necurs.A
File System Details
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | SetupRun.exe | 0fcf85fb87bcfa15b79e755ae1f94c9f | 121 |
| 2. | 124kkk290347.exe | 4eff5a56cf636142d18d2c1bab26bf2c | 43 |
| 3. | zipprm.exe | 0dd6eb3ecd3fec49520588e3b1183c8c | 26 |
| 4. | ToolbarUpdater.exe | 646cdc657a3900d4674042b1937f293f | 21 |
| 5. | Tv-setup.exe | 889184cb35120bb649327a85ab2983b6 | 17 |
| 6. | viwc.exe | 75d53bf658a4828b7b502006d638e8d5 | 9 |
| 7. | NPIEAddOn.dll | 2774b7f51fffd9a43ea0ad308e16ea94 | 9 |
| 8. | n. | cfcbf2a7f5dac05c43a480d315a86034 | 9 |
| 9. | ancamcorderupdate.exe | 455750d4ba1f352a5f10892b8d91e52a | 8 |
| 10. | zbejexdng.dll | ac52a602bd8ed5bc1df889b509118a71 | 5 |
| 11. | winmedia.exe | a619e2bf97bd26653f408ed48565a740 | 4 |
| 12. | AutoProtect.vbs | 50d0524d9f17f54f1eaef2bccdf2ff45 | 3 |
| 13. | 8fe5055635f26f6.sys | 3e080f5dd86d6e30a8c678ec86c6ca98 | 3 |
| 14. | ssd.dll | ea8b172efba3900e1cf25f06678226e6 | 3 |
| 15. | Audio Intel HD.exe | f817b6eadce15830e8ae229c19d2a902 | 3 |
| 16. | 60dc042.sys | 4ee8793232b62882c96b2033a1abc115 | 3 |
| 17. | EC84.exe | 8435a53c380ba1b9c49979b83f8f49b7 | 2 |
| 18. | winrar.exe | 90be6ef986e92be051988ec56ecb5b03 | 2 |
| 19. | stbapp.exe | 6d81b0897572c61fb9f9193637648435 | 2 |
| 20. | GBPErase.sys | 3742c49353e4452857f47d7c14fbce7a | 1 |
| 21. | 1de0e.sys | 7b7dbb626b0570ba45d7aaf5e2b8a53a | 1 |
| 22. | 19617.sys | 36fdac5290be0be8825d3761def4a95c | 1 |
| 23. | 1a4c49e.sys | 8abf62df7199b39846b63095402d6c3c | 1 |
| 24. | winsvchost.exe | e82cd32fefb2f009c84c14cec1f13624 | 1 |
| 25. | 013ae0e3a075.exe | 0dae19442a5c488039e59bb01330839c | 1 |
| 26. | 6a8383.sys | 11e857f4e89a14bd78e2115cd7a8eaba | 1 |