Backdoor

Backdoor.Win32.DarkKomet.xyk removal instruction

Malware Removal

The Backdoor.Win32.DarkKomet.xyk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.DarkKomet.xyk virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Drops a binary and executes it
  • Uses Windows utilities for basic functionality
  • Sniffs keystrokes
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a copy of itself
  • Interacts with known DarkComet registry keys
  • Creates known Fynloski/DarkComet mutexes
  • Anomalous binary characteristics
  • Contains RAT configuration for DarkComet (see Static Analysis tab)

How to determine Backdoor.Win32.DarkKomet.xyk?


File Info:

crc32: 14476819
md5: a836680cde2fc4dcdf14561487cb3e48
name: 563521c44069a6cd.exe
sha1: bad13610bc4644b7f152e2e01a980fda25a77d6e
sha256: ea4175b11d2ea01eadde409ea7222f5060dcb218ffed00ea111cec726b12f8af
sha512: 3e1b8e1d6f2d71410cb2fbb245f3eb80de3242ce7420f36feff721bcaeb307b6f12c82e110287b85ac2cf3aeadeb3a6d67b4cefb771be78c312e07d4f37a0fc1
ssdeep: 12288:f9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hVKlKebJo:JZ1xuVVjfFoynPaVBUR8f+kN10EB3h/
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 1999
InternalName: MSRSAAPP
FileVersion: 1, 0, 0, 1
CompanyName: Microsoft Corp.
Comments: Remote Service Application
ProductName: Remote Service Application
ProductVersion: 4, 0, 0, 0
FileDescription: Remote Service Application
OriginalFilename: MSRSAAP.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.DarkKomet.xyk also known as:

BkavW32.OnGamesLTKVPOK.Trojan
MicroWorld-eScanTrojan.Inject.AUZ
FireEyeGeneric.mg.a836680cde2fc4dc
CAT-QuickHealBackdoor.Fynloski.A9
ALYacTrojan.Inject.AUZ
CylanceUnsafe
VIPREBackdoor.Win32.Fynloski.A (v)
SangforMalware
K7AntiVirusBackdoor ( 003b505d1 )
BitDefenderTrojan.Inject.AUZ
K7GWBackdoor ( 003b505d1 )
CrowdStrikewin/malicious_confidence_100% (W)
Invinceaheuristic
BaiduWin32.Backdoor.Agent.l
F-ProtW32/Downloader.C.gen!Eldorado
SymantecBackdoor.Graybird
TotalDefenseWin32/Fynloski.A!generic
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.DarkKomet-1
GDataWin32.Backdoor.DarkComet.H
KasperskyBackdoor.Win32.DarkKomet.xyk
AlibabaBackdoor:Win32/Fynloski.a379d416
NANO-AntivirusTrojan.Win32.DarkKomet.dtlfre
AvastMSIL:GenMalicious-CHX [Trj]
RisingBackdoor.Pontoeb!1.6637 (CLASSIC)
Ad-AwareTrojan.Inject.AUZ
EmsisoftTrojan.Inject.AUZ (B)
ComodoBackdoor.Win32.Agent.XAB@4of2bc
F-SecureBackdoor.BDS/DarkKomet.GS
DrWebBackDoor.Tordev.976
ZillyaBackdoor.DarkKomet.Win32.30208
TrendMicroBKDR_FYNLOS.SMM
McAfee-GW-EditionBehavesLike.Win32.Backdoor.bh
MaxSecureBackdoor.DarkComet
Trapminemalicious.moderate.ml.score
CMCBackdoor.Win32.DarkKomet!O
SophosTroj/Backdr-ID
IkarusBackdoor.Win32.DarkKomet
CyrenW32/Downloader.C.gen!Eldorado
JiangminTrojan/Generic.adygq
WebrootW32.Trojan.Gen
AviraBDS/DarkKomet.GS
MAXmalware (ai score=100)
Antiy-AVLTrojan[Backdoor]/Win32.DarkKomet.xyk
KingsoftWin32.Hack.HuigeziT.cz
Endgamemalicious (high confidence)
ArcabitTrojan.Inject.AUZ
SUPERAntiSpywareTrojan.Agent/Gen-Fynloski
ZoneAlarmBackdoor.Win32.DarkKomet.xyk
MicrosoftBackdoor:Win32/Fynloski.A
AhnLab-V3Win-Trojan/Keylogger.679832
Acronissuspicious
McAfeeGeneric BackDoor.xa
TACHYONBackdoor/W32.DP-Fynloski.774144
VBA32Backdoor.Tordev
MalwarebytesSpyware.KeyLogger
ZonerTrojan.Win32.61982
ESET-NOD32Win32/Fynloski.AA
TrendMicro-HouseCallBKDR_FYNLOS.SMM
TencentBackdoor.Win32.Darkkomet.a
YandexTrojan.Comet.Gen.LO
SentinelOneDFI – Malicious PE
eGambitRAT.DarkComet
FortinetW32/Generic.AC.25E!tr
BitDefenderThetaAI:Packer.1FE593EA1C
AVGMSIL:GenMalicious-CHX [Trj]
Cybereasonmalicious.cde2fc
PandaTrj/Packed.B
Qihoo-360Win32/Backdoor.DarkKomet.A

How to remove Backdoor.Win32.DarkKomet.xyk?

Backdoor.Win32.DarkKomet.xyk removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment