Should I remove “Backdoor.Win32.DevBot.d”?

The Backdoor.Win32.DevBot.d is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.DevBot.d virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Backdoor.Win32.DevBot.d?

File Info:
name: 4E6187D65ABDF8092C35.mlw
path: /opt/CAPEv2/storage/binaries/e376530c09faed18f45f08c47aed08ff38d55fcaa98986df7c84c5cdc649dab7
crc32: 10D0461A
md5: 4e6187d65abdf8092c352b6d04da4af7
sha1: 0ba6b2f826439a54a7e6c08271f3d0cb7179275b
sha256: e376530c09faed18f45f08c47aed08ff38d55fcaa98986df7c84c5cdc649dab7
sha512: fe3ccd4d9aeb508c9dcd0fbaa5aa59a43b5936389ade770c6687cce594b24b1e10dcea473cc3326484b931fd6a7e1ef2abd91326637d6471df2654b2850a5aac
ssdeep: 6144:+XqhI966AGkAjOpoaY7hAAY27yZniIms+QTfQXT:+X2q6xGJOpqBRypiI3KT
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1FF5423725CA298E0D1151E71AF0547E01A4AE7F73DB8E14760D2BB916CCB9E3AF83630
sha3_384: e75d422ff58636bff809ee856722e9a81794fc4fcf36ca5209817f17cf725e04f79077c15e46c6287c0f1f928390d2d4
ep_bytes: 6801904000e801000000c3c3f4d39163
timestamp: 2010-07-02 21:48:06

Version Info:
Comments: 
CompanyName: 游防科技
FileDescription: workstation
FileVersion: 1, 0, 0, 1
InternalName: workstation
LegalCopyright: Copyright ? 2008
LegalTrademarks: 
OriginalFilename: workstation.exe
PrivateBuild: 
ProductName: workstation
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0804 0x04b0

Backdoor.Win32.DevBot.d also known as:

How to remove Backdoor.Win32.DevBot.d?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.