Backdoor.Win32.Emotet.apqu removal tips

The Backdoor.Win32.Emotet.apqu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Emotet.apqu virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Emotet.apqu?


File Info:
crc32: 16D2C877
md5: ba18e05c6ba3243c7e597aa1c9c5431c
name: upload_file
sha1: 21c703c66c872b2d319c9247418f602c6e7fa25e
sha256: 5db244f0ecae735d720c94d75844dbb771d53df4c6ebc72a6d09446207c7228d
sha512: b112aca64d01592668c9d55cfec4d8cf206b2307ebb8e4f10a983ccab624e43200d70260d5f6684647d5485e08698e3f7c913411daa030a8fa62bdc5cf7b1d2f
ssdeep: 12288:1H9tNCsqbIoCyJgllh/krhMxUqKsRR2Bw:ftEfbjJglvnyBw
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2000
InternalName: MsAgentHelp
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: MsAgentHelp Application
ProductVersion: 1, 0, 0, 1
FileDescription: MsAgentHelp MFC Application
OriginalFilename: MsAgentHelp.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.apqu also known as:

FireEye	Generic.mg.ba18e05c6ba3243c
McAfee	Emotet-FRI!BA18E05C6BA3
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
BitDefender	Trojan.GenericKD.34266376
K7GW	Riskware ( 0040eff71 )
TrendMicro	TROJ_GEN.R011C0DGV20
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
GData	Trojan.GenericKD.34266376
Kaspersky	Backdoor.Win32.Emotet.apqu
Alibaba	Malware:Win32/BankerX.98f3581d
AegisLab	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.34266376
Endgame	malicious (high confidence)
Emsisoft	Trojan.Emotet (A)
DrWeb	Trojan.Emotet.995
Invincea	heuristic
Sophos	Troj/Emotet-CKL
Cyren	W32/Trojan.QZNP-8155
MAX	malware (ai score=80)
Arcabit	Trojan.Generic.D20ADD08
ZoneAlarm	Backdoor.Win32.Emotet.apqu
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
AhnLab-V3	Trojan/Win32.Emotet.R346459
VBA32	BScope.Trojan.Emotet
ALYac	Trojan.GenericKD.34266376
Ad-Aware	Trojan.GenericKD.34266376
Malwarebytes	Trojan.MalPack.TRE
Panda	Trj/Emotet.C
ESET-NOD32	a variant of Win32/Kryptik.HFGP
TrendMicro-HouseCall	TROJ_GEN.R011C0DGV20
Rising	Trojan.Kryptik!1.C82B (CLOUD)
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/GenKryptik.EPAZ!tr
BitDefenderTheta	Gen:NN.ZexaF.34144.Cq0@ayO8rWji
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.7f9

How to remove Backdoor.Win32.Emotet.apqu?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Emotet.apqu removal tips