Backdoor.Linux.Gafgyt.cn removal guide

The Backdoor.Linux.Gafgyt.cn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Linux.Gafgyt.cn virus can do?

Injection (inter-process)
Injection with CreateRemoteThread in a remote process
Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
A potential decoy document was displayed to the user
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Linux.Gafgyt.cn?


File Info:
crc32: 5F00FE01
md5: edcd40152b43194fabd4bd9272b58dc6
name: tmpgk3hnyu0
sha1: ea3db321a75ba8a16c36e005313182b0e3a20eba
sha256: 1011d4679fab1a361c92a9dbf018a48bd334004fbd3419650fe4cf91fe1686c1
sha512: 15a1f956ea9bcd83522da12c68e3a2a60efb02f08284453f8e5f5a16f484780efa0c8719d77fd5bbb6d5b5625e4d55370472c982e97029e7f7d0f500adee8103
ssdeep: 3072:jLm+77c04z0k9szw74sYu2z2VzpykjGiq4:jLFyQw74sZ24ykfq4
type: ELF 32-bit MSB  executable, Motorola 68020 - invalid byte order, version 1 (SYSV), statically linked, stripped

Version Info:
0: [No Data]

Backdoor.Linux.Gafgyt.cn also known as:

DrWeb	Linux.Mirai.1834
MicroWorld-eScan	Gen:Variant.Trojan.Linux.Gafgyt.8
FireEye	Gen:Variant.Trojan.Linux.Gafgyt.8
ALYac	Gen:Variant.Trojan.Linux.Gafgyt.8
Sangfor	Malware
BitDefenderTheta	Gen:NN.Mirai.34128
ESET-NOD32	a variant of Linux/Mirai.A
TrendMicro-HouseCall	Backdoor.Linux.BASHLITE.SMJC8
Avast	ELF:Hajime-R [Trj]
ClamAV	Unix.Trojan.Mirai-6987932-0
GData	Linux.Trojan.Gafgyt.B
Kaspersky	HEUR:Backdoor.Linux.Gafgyt.cn
BitDefender	Gen:Variant.Trojan.Linux.Gafgyt.8
Rising	Backdoor.Mirai/Linux!1.BAFF (CLASSIC)
Ad-Aware	Gen:Variant.Trojan.Linux.Gafgyt.8
Emsisoft	Gen:Variant.Trojan.Linux.Gafgyt.8 (B)
F-Secure	Malware.LINUX/Mirai.bonb
TrendMicro	Backdoor.Linux.BASHLITE.SMJC8
Ikarus	Trojan.Linux.Tsunami
Cyren	ELF/Mirai.G.gen!Camelot
Avira	LINUX/Mirai.bonb
Microsoft	DDoS:Linux/Gafgyt.YA!MTB
Arcabit	Trojan.Trojan.Linux.Gafgyt.8
AhnLab-V3	Linux/Mirai.Gen10
ZoneAlarm	HEUR:Backdoor.Linux.Gafgyt.cn
Avast-Mobile	ELF:Mirai-UM [Trj]
Cynet	Malicious (score: 85)
Tencent	Backdoor.Linux.Mirai.wcz
MAX	malware (ai score=84)
Fortinet	ELF/Mirai.AE!tr
AVG	ELF:Hajime-R [Trj]

How to remove Backdoor.Linux.Gafgyt.cn?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Linux.Gafgyt.cn removal guide