Backdoor.Win32.Lotok.qhm removal

The Backdoor.Win32.Lotok.qhm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Lotok.qhm virus can do?

• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor.Win32.Lotok.qhm?

File Info:
name: F5F71EB611BEA0E9A7AD.mlw
path: /opt/CAPEv2/storage/binaries/8672dbfa975b39a499e71d0f8bfe2d6175aa693bc0397f2ff2c13ea15869bfa3
crc32: F20F2DD3
md5: f5f71eb611bea0e9a7ad39b12b4e38cf
sha1: 5d1a1323297c3ec18c2764aa2c551e2c0a90c896
sha256: 8672dbfa975b39a499e71d0f8bfe2d6175aa693bc0397f2ff2c13ea15869bfa3
sha512: 9964d1f5623c924f77a2826c59212b3406fb86884d1280b809b297e576871ca3e74b2495685fa555ad00701515361c7285a5f1f6e64da5c7d655b9feaf4f0d69
ssdeep: 98304:S06FOznLo0+Dd6uxcOzVK5ao8iDTS3cSki+HNvzCmAuEjc:S3F6n80W6uG6Ia2Du3hki+HNvzEw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137162346F292D0B2E56900F84525D6B68D39BD3287B9C4F3AFD03D6E5D702E0E63361A
sha3_384: fd30bd4ca1ea7a0246d9e13ceef40f53ce354974581f73e600accb821a7130e7fe45e0ae7f4dc4ab0174cc6e90718fb2
ep_bytes: e8a61d0000e989feffff8bff565733f6
timestamp: 2012-06-14 16:16:10

Version Info:
Comments: 100SUIEYIU2H34DDWsss
CompanyName: 100SUIEYIU2H34DDWsss
FileDescription: 100SUIEYIU2H34DDWsss
FileVersion: 100.0.0.0
OriginalFilename: suf_launch.exe
ProductName: 100SUIEYIU2H34DDWsss
ProductVersion: 100.0.0.0
Translation: 0x0409 0x0000

Backdoor.Win32.Lotok.qhm also known as:

How to remove Backdoor.Win32.Lotok.qhm?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.