How to remove IcedId Spyware from PC?

In this article, I will tell you about the indications of IcedId spyware existence, and the best way to eliminate IcedId spyware virus from your computer system.

GridinSoft Anti-Malware
Editor's choice
GridinSoft Anti-Malware
Manual IcedId removal might be a lengthy and complicated process that requires expert skills. GridinSoft Anti-Malware is a professional antivirus tool that is recommended to get rid of this IcedId spyware trojan.
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for GridinSoft Anti-Malware. 6 days free trial available.

Describing IcedId spyware

IcedId TrojanSpy as the computer virus is not an autonomous app, but a component of considerably more expansive and complicated malware – trojan-stealer. It’s a kind of trojan, which is targeted on your personal information, and also accumulates really every little thing concerning you and also your system. Generally, stealers have keylogger capabilities1, which empower them to gather your keystrokes. Besides that, IcedId virus can accumulate your cookie files, your telephone number, location; it also can take all your passwords from the keychain within the web browser.

Name IcedId
Infection Type Spyware
  • SetUnhandledExceptionFilter detected (possible anti-debug);
  • Behavioural detection: Executable code extraction – unpacking;
  • Yara rule detections observed from a process memory dump/dropped files/CAPE;
  • Creates RWX memory;
  • Possible date expiration check, exits too soon after checking local time;
  • Dynamic (imported) function loading detected;
  • CAPE extracted potentially suspicious content;
  • Authenticode signature is invalid;
Similar behavior Laqma, Blanajog, Fitin
Fix Tool

See If Your System Has Been Affected by IcedId spyware

Nevertheless, the significant share of IcedId spy are seeking for your banking data: credit card number, safety codes and expiration date. In situation if you use online banking, the IcedId stealer virus is able to jeopardize your login and password, so the criminals will certainly get access to your bank account. Various business data may likewise be an item of interest of IcedId virus distributors, and in case of huge companies such data pass might create harmful results.

Statistics of spyware activity in 2020
TrojanSpy activity in 2020, compared to backdoor viruses activity

The primary dispersal manners of IcedId spyware are very similar to various other trojans. Nowadays, the majority of such applications are dispersed via e-mail attachments. These attachments (. docx,. pdf documents) have corrupted macroses, which are utilized by IcedId spy to corrupt your computer. Often, such mails have web links to the phishing duplicates of official web pages, like Facebook, Twitter, LinkedIn or so.

Rating of different spyware activity

Most popular spyware in 20202

It is essential to specify that there is a solitary kind of spyware – for Android operating system. Such apps have comparable functionalities as the computer version does, however, mobile malware is spread as a legit application for checking the girlfriend’s or kids’s area. Nevertheless, besides thieving various private data, it can also demonstrate to you a entirely inaccurate place of the phone you are trying to track. Such scenarios might create beefs out of the blue.

How can I understand that my computer is infected with IcedId spyware?

IcedId spy is a really stealth malware, simply because its performance depends on how long it can operate prior to being detected. So, IcedId spyware producers made everything to make their program presence as invisible as feasible. Obviously, you will discover that your profiles in social networks are taken, and cash from your financial account is moving away, however it is far too late.

IcedId also known as

Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.DHHD
FireEye Generic.mg.c7db805bd2039772
CAT-QuickHeal Trojan.Mauvaise.SL1
ALYac Trojan.Agent.DHHD
K7AntiVirus Spyware ( 0053a26d1 )
Alibaba TrojanDropper:Win32/dropper.ali1003001
K7GW Spyware ( 0053a26d1 )
CrowdStrike win/malicious_confidence_90% (W)
Cyren W32/S-d52d1cdf!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Spy.IcedId.H
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.IcedID-7070619-0
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Trojan.Agent.DHHD
NANO-Antivirus Trojan.Win32.IcedID.fjnapi
Avast Win32:Trojan-gen
Tencent Malware.Win32.Gencirc.10b26592
Ad-Aware Trojan.Agent.DHHD
Comodo [email protected]
DrWeb Trojan.IcedID.13
Zillya Adware.Yakes.Win32.67
TrendMicro TrojanSpy.Win32.ICEDID.YXBK2Z
Emsisoft Trojan.Agent.DHHD (B)
SentinelOne Static AI – Suspicious PE
GData Trojan.Agent.DHHD
Jiangmin Trojan.Yakes.ablg
Avira HEUR/AGEN.1126938
MAX malware (ai score=88)
Antiy-AVL Trojan/Generic.ASMalwS.28AFB82
Gridinsoft Ransom.Win32.Gen.sa
ViRobot Trojan.Win32.Z.Icedid.475136.DC
Microsoft TrojanSpy:Win32/IcedId.B!dha
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Yakes.R240822
McAfee GenericR-OCV!C7DB805BD203
VBA32 Trojan.Yakes
Malwarebytes Malware.AI.778878971
TrendMicro-HouseCall TrojanSpy.Win32.ICEDID.YXBK2Z
Rising Spyware.IcedId!1.B487 (CLASSIC)
Yandex Trojan.Yakes!X047gFKqHe4
Ikarus Trojan-Ransom.GandCrab
Fortinet W32/IcedId.H!tr.spy
BitDefenderTheta Gen:[email protected]
AVG Win32:Trojan-gen
Cybereason malicious.bd2039
Panda Trj/Genetic.gen

Domains that associated with IcedId:

What are the symptoms of IcedId trojan?

  • SetUnhandledExceptionFilter detected (possible anti-debug);
  • Behavioural detection: Executable code extraction – unpacking;
  • Yara rule detections observed from a process memory dump/dropped files/CAPE;
  • Creates RWX memory;
  • Possible date expiration check, exits too soon after checking local time;
  • Dynamic (imported) function loading detected;
  • CAPE extracted potentially suspicious content;
  • Authenticode signature is invalid;

To avoid injection of IcedId spyware, stay away from launching any additions to the emails from unfamiliar addresses. Nowadays, throughout quarantine, email-distributed malware becomes even more active. Users (specifically ones that started purchasing everything on online-marketplaces) do not take note to the weird e-mail addresses, and open whatever that gets to their email. And IcedId stealer is right in such messages.

How to remove IcedId spyware?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You can attempt to do it manually, nevertheless, like any other trojan, IcedId TrojanSpy implements the alterations pretty deep within the system. For this reason, it’s incredibly tough to locate all these modifications, and even more challenging to clean them out. To take care of this hazardous malware totally, I can recommend you to utilize GridinSoft Anti-Malware.


To detect and delete all malicious programs on your personal computer with GridinSoft Anti-Malware, it’s better to utilize Standard or Full scan. Quick Scan is not able to find all malicious items, because it checks only the most popular registry entries and directories.

Scan types in Gridinsoft Anti-Malware

You can see the detected malicious programs sorted by their possible hazard simultaneously with the scan process. But to perform any actions against the viruses, you need to wait until the scan is over, or to stop the scan.

GridinSoft Anti-Malware during the scan

To set the action for each spotted malicious or unwanted program, click the arrow in front of the name of detected virus. By default, all the viruses will be moved to quarantine.

List of detected malware after the scan

How to remove IcedId Spyware?

Name: IcedId

Description: IcedId TrojanSpy is classified as a type of malware — malicious software designed to gain access to or damage your computer, often without your knowledge. The IcedId gathers your personal information and relays it to advertisers, data firms, or external users. The IcedId can install additional software and change the security settings on your PC.

Operating System: Windows

Application Category: Spyware

User Review
4.09 (11 votes)
Comments Rating 0 (0 reviews)
  1. What is Spyware: https://en.wikipedia.org/wiki/Spyware
  2. ESET quaterly report: ESET_Threat_Report_Q22020.pdf

William Reddy

I am from Ireland. My parents bought me a computer when I was 11, and several month after I have got a virus on this PC. I decided to enter the INSA Centre Val de Loire university after being graduated from the school. This French educational institution was offering a brand-new cybersecurity course. After getting the master degree in cybersecurity, I've started working in as virus analyst in a little anti-malware vendor. In 2018, I've decided to start Virus Removal project. The main target of this site is to help people to deal with PC viruses of any kind.

Leave a Reply

Your email address will not be published.


Back to top button