Should I remove "Backdoor.Win32.Emotet.ciwt"?

The Backdoor.Win32.Emotet.ciwt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Emotet.ciwt virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Emotet.ciwt?


File Info:
crc32: E2BAB1A2
md5: 87dc895a5005732850d2b480e6d0b7cf
name: upload_file
sha1: 1a40031be7aebf342a969a2b1cb762365d1eb2b9
sha256: c5865bf3149c6d85b8f073a6610395b2de792091d007b63b6ceaf18a129193b8
sha512: 6a7a453ac8c5a79b12482df3f1da45e2f36f96d37e624b0086fb7c5614a79620f2d38bb815c3018cc144f70b982223dbb48d2ced7b5549d20d081efe1b055021
ssdeep: 1536:xWVZeToiUSSZRq9oidl5SYuO7a8LYQi7Y8X+DCfqBSpxFvR:VYRqOiGGaEYDM8uD98f
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2004
InternalName: BrowseCtrlDemo
FileVersion: 1, 0, 0, 1
CompanyName: 
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: BrowseCtrlDemo Application
SpecialBuild: 
ProductVersion: 1, 0, 0, 1
FileDescription: BrowseCtrlDemo MFC Application
OriginalFilename: BrowseCtrlDemo.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.ciwt also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.Agent.EVFI
FireEye	Trojan.Agent.EVFI
CAT-QuickHeal	Trojan.Wacatac
Qihoo-360	Win32/Backdoor.e63
McAfee	Emotet-FRV!87DC895A5005
Cylance	Unsafe
Zillya	Backdoor.Emotet.Win32.1055
K7AntiVirus	Trojan ( 0056caa71 )
BitDefender	Trojan.Agent.EVFI
K7GW	Trojan ( 0056caa71 )
Cyren	W32/Emotet.APY.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	Backdoor.Win32.Emotet.ciwt
Alibaba	Trojan:Win32/Emotet.df533086
NANO-Antivirus	Trojan.Win32.Emotet.hrnuoi
ViRobot	Trojan.Win32.Emotet.118784.F
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ad-Aware	Trojan.Agent.EVFI
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Crypt.Agent.kgdjc
DrWeb	Trojan.DownLoader34.25061
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.THHAHBO
Sophos	Troj/Emotet-CLF
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.rj
Webroot	W32.Trojan.Emotet
Avira	TR/Crypt.Agent.kgdjc
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Arcabit	Trojan.Agent.EVFI
ZoneAlarm	Backdoor.Win32.Emotet.ciwt
GData	Trojan.Agent.EVFI
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Emotet.R348099
ALYac	Trojan.Agent.EVFI
TACHYON	Backdoor/W32.Emotet.118784.B
VBA32	BScope.Trojan.Downloader
Malwarebytes	Trojan.BitCoinMiner
Panda	Trj/Agent.PM
ESET-NOD32	a variant of Win32/Kryptik.HFOM
TrendMicro-HouseCall	Trojan.Win32.WACATAC.THHAHBO
Tencent	Win32.Backdoor.Emotet.Edei
Fortinet	W32/Kryptik.HFMI!tr
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
MaxSecure	Trojan.Malware.121218.susgen

How to remove Backdoor.Win32.Emotet.ciwt?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “Backdoor.Win32.Emotet.ciwt”?