Backdoor.MSIL.NanoBot.aiqg removal guide

The Backdoor.MSIL.NanoBot.aiqg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.MSIL.NanoBot.aiqg virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Unconventionial language used in binary resources: Spanish (Modern)
The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.MSIL.NanoBot.aiqg?


File Info:
crc32: F3F3E24E
md5: 3b6a331feff3103fb596a9580e6ba6da
name: 3B6A331FEFF3103FB596A9580E6BA6DA.mlw
sha1: 1e3bd19e258c1c0b01da61530063131732699ea9
sha256: 075464771d17321cb72842de04b78a9df223c8e61bf0f196b4bbe27898be89fe
sha512: e0788295e5b6e3004a2582283d7275c042e4692051877fc8adb05451059923a41bc38ecdb4e01e23ea845bd6e77518658462336b2291e634bcca630d7001ef54
ssdeep: 12288:KnkXY7p8wRtrt6Ruu58L5Kz6tZx/Jr8mRn1:uPp8qt5oM5Kz6tZRJr8mR
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
InternalName: retouches
FileVersion: 1.00
CompanyName:  kAsPeRSkY LAb 
LegalTrademarks:  fiNAREa S.A. SWITzerland    
Comments:  insTANTBIRD    
ProductName:  coDe labORATORIes, Inc.    
ProductVersion: 1.00
FileDescription:  auDAcITY TEam    
OriginalFilename: retouches.exe

Backdoor.MSIL.NanoBot.aiqg also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.PonyStealer.Gm1@dyPQMdSi
FireEye	Generic.mg.3b6a331feff3103f
McAfee	Fareit-FNL!3B6A331FEFF3
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
BitDefender	Gen:Heur.PonyStealer.Gm1@dyPQMdSi
CrowdStrike	win/malicious_confidence_100% (D)
TrendMicro	Trojan.Win32.BAMAPANO.SM3.hp
Cyren	W32/VBInject.UL.gen!Eldorado
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Packed.Nanobot-6847262-0
Kaspersky	Backdoor.MSIL.NanoBot.aiqg
Rising	Backdoor.NanoBot!8.28C (TFE:3:KAs5dWFTvxU)
Ad-Aware	Gen:Heur.PonyStealer.Gm1@dyPQMdSi
Emsisoft	Gen:Heur.PonyStealer.Gm1@dyPQMdSi (B)
F-Secure	Heuristic.HEUR/AGEN.1130126
DrWeb	Trojan.Nanocore.23
Invincea	ML/PE-A
McAfee-GW-Edition	Fareit-FNL!3B6A331FEFF3
Jiangmin	Backdoor.MSIL.aykn
Avira	HEUR/AGEN.1130126
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/Caynamer.A!ml
Arcabit	Trojan.PonyStealer.EDEFD5
ZoneAlarm	Backdoor.MSIL.NanoBot.aiqg
GData	Gen:Heur.PonyStealer.Gm1@dyPQMdSi
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.VBCrypt.R252790
BitDefenderTheta	Gen:NN.ZevbaF.34590.Gm1@ayPQMdSi
ALYac	Gen:Heur.PonyStealer.Gm1@dyPQMdSi
VBA32	TScope.Trojan.VB
Malwarebytes	Trojan.MalPack.VB
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Injector.EDCK
TrendMicro-HouseCall	Trojan.Win32.BAMAPANO.SM3.hp
Yandex	Backdoor.NanoBot!NVdleyG6lEM
SentinelOne	Static AI – Malicious PE
eGambit	PE.Heur.InvalidSig
Fortinet	W32/GenKryptik.CWPW!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.feff31
Qihoo-360	HEUR/QVM03.0.38DF.Malware.Gen

How to remove Backdoor.MSIL.NanoBot.aiqg?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.MSIL.NanoBot.aiqg removal guide