Categories: Backdoor

Backdoor.Win32.Lotok.dqo removal

The Backdoor.Win32.Lotok.dqo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Lotok.dqo virus can do?

Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Creates a hidden or system file
Network activity detected but not expressed in API logs

How to determine Backdoor.Win32.Lotok.dqo?


File Info:
crc32: BD44543Cmd5: d243683f4bc6adf283de344e0f0ba6cbname: D243683F4BC6ADF283DE344E0F0BA6CB.mlwsha1: bd8815e4b8aedb7872ffbd8a2ab0162fcd727e18sha256: 4e8987b5f7e1eec411334c12a660df296e36af7e2c4702ee050ab453c8da31aasha512: c1fbdff4ce22b85a563648854eee076697bc07d7625d337f69320cc99090846ebb1a8b13b570c12335bfeec7774a46b1cadb5b455a636fc43670c109ee974488ssdeep: 12288:j7eohATdPF2Gp33V6K9gc3CnkcTXHWDGpHeI8lwYajtXhEDq66+qVhoYoSS:P0P5J3VU4CksHbp+ISnajtxoq66Bgtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: x8010x514bx6570x636e x7248x6743x6240x6709FileVersion: 3.4.0.0CompanyName: x8010x514bx6570x636eComments: x672cx7a0bx5e8fx4f7fx7528x6613x8bedx8a00x7f16x5199(http://www.eyuyan.com)ProductName: x7206x7387x8c03x6574x5de5x5177ProductVersion: 3.4.0.0FileDescription: x7206x7387x8c03x6574x5de5x5177v3.4Translation: 0x0804 0x04b0

Backdoor.Win32.Lotok.dqo also known as:

K7AntiVirus	Trojan ( 005246d51 )
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader30.39861
Cynet	Malicious (score: 100)
CAT-QuickHeal	Hacktool.Flystudio.16558
ALYac	Trojan.GenericKD.45387484
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Backdoor:Win32/Lotok.b95a0c45
K7GW	Trojan ( 00013a151 )
Cybereason	malicious.4b8aed
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Backdoor.Win32.Lotok.dqo
BitDefender	Trojan.GenericKD.45387484
NANO-Antivirus	Trojan.Win32.Lotok.ihxlyu
MicroWorld-eScan	Trojan.GenericKD.45387484
Ad-Aware	Trojan.GenericKD.45387484
Sophos	Mal/Generic-S (PUA)
Comodo	Packed.Win32.MUPX.Gen@24tbus
F-Secure	Backdoor.BDS/Redcap.wsjln
BitDefenderTheta	Gen:NN.ZexaF.34804.PmKfaKV@OJnb
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
FireEye	Generic.mg.d243683f4bc6adf2
Emsisoft	Trojan.GenericKD.45387484 (B)
SentinelOne	Static AI – Malicious PE
Avira	BDS/Redcap.wsjln
eGambit	Unsafe.AI_Score_99%
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Generic.D2B48EDC
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	Backdoor.Win32.Lotok.dqo
GData	Win32.Application.PUPStudio.A
Acronis	suspicious
McAfee	Artemis!D243683F4BC6
Malwarebytes	Malware.Heuristic.1003
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CAC21
Rising	Backdoor.Lotok!8.111D5 (CLOUD)
Yandex	Backdoor.Lotok!iem1dx4KSaA
Ikarus	Trojan.Win32.Crypt
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/Agent.65CA!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml