Backdoor.Win32.AutoIt.ed removal instruction

The Backdoor.Win32.AutoIt.ed is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.AutoIt.ed virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to remove evidence of file being downloaded from the Internet
Exhibits behavior characteristic of Nanocore RAT
Creates a slightly modified copy of itself
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

remitancegp.duckdns.org

How to determine Backdoor.Win32.AutoIt.ed?


File Info:
crc32: 93580C55
md5: 93131f22f916ef09d8557f9c9e338814
name: 93131F22F916EF09D8557F9C9E338814.mlw
sha1: 920e568c06aa4d6370bb1d81c0a25936117017a3
sha256: 7281889000027d55fe9ea221aac1fa00f269c66235a1583fd950b364641a6d67
sha512: a75c222a5d90c32a9070401460a6377647bd01a5c479f23a0bebf43726d9de5499aff9b9b8de799a40086028b94508ec43907b867cac5e1aa6d33312442b8583
ssdeep: 24576:+rl6kD68JmloOtX9FpAk6SAl/+PiHTg6b9S:8l328U2UXnpt4WP8Tg68
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: RMActivate
FileVersion: 883.639.551.178
CompanyName: tabcal
ProductName: xcopy
ProductVersion: 25.862.807.771
FileDescription: sftp
OriginalFilename: diskperf
Translation: 0x0409 0x04b0

Backdoor.Win32.AutoIt.ed also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.AutoIT.16
CAT-QuickHeal	Backdoor.AutoIt
McAfee	Packed-FTE!93131F22F916
Cylance	Unsafe
VIPRE	Packer.NSAnti.Gen (v)
Sangfor	Malware
K7AntiVirus	Trojan ( 700000111 )
BitDefender	Gen:Trojan.Heur.AutoIT.16
K7GW	Trojan ( 700000111 )
Cybereason	malicious.2f916e
TrendMicro	Trojan.AutoIt.CRYPTINJECT.SMA
Cyren	W32/AutoIt.QA2.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	AutoIt:Injector-JF [Trj]
ClamAV	Win.Malware.Nymeria-6963007-0
Kaspersky	Backdoor.Win32.AutoIt.ed
Tencent	Malware.Win32.Gencirc.10ce12d3
Ad-Aware	Gen:Trojan.Heur.AutoIT.16
Sophos	Troj/AutoIt-CLG
F-Secure	Heuristic.HEUR/AGEN.1114570
DrWeb	Trojan.AutoIt.421
Invincea	ML/PE-A + Troj/AutoIt-CLG
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.cc
FireEye	Generic.mg.93131f22f916ef09
Emsisoft	Gen:Trojan.Heur.AutoIT.16 (B)
Ikarus	Trojan-Spy.HawkEye
Avira	HEUR/AGEN.1114570
Antiy-AVL	GrayWare/Autoit.ShellCode.a
Microsoft	Trojan:Win32/Wacatac.D7!ml
Arcabit	Trojan.Heur.AutoIT.16
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
ZoneAlarm	Backdoor.Win32.AutoIt.ed
GData	Gen:Trojan.Heur.AutoIT.16
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C3201746
Acronis	suspicious
BitDefenderTheta	AI:Packer.D2112E0817
MAX	malware (ai score=85)
Malwarebytes	Trojan.MalPack.Generic
ESET-NOD32	a variant of Win32/Packed.AutoIt.PK
TrendMicro-HouseCall	Trojan.AutoIt.CRYPTINJECT.SMA
Rising	PUF.Pack-AutoIt!1.B8E7 (CLASSIC)
eGambit	Unsafe.AI_Score_94%
Fortinet	AutoIt/Scar.RWET!tr
AVG	AutoIt:Injector-JF [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Backdoor.Win32.AutoIt.ed?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.AutoIt.ed removal instruction