Backdoor

Backdoor.Win32.Lotok removal guide

Malware Removal

The Backdoor.Win32.Lotok is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Lotok virus can do?

  • Executable code extraction
  • A process attempted to delay the analysis task.
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Deletes its original binary from disk
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings
  • Creates a copy of itself

How to determine Backdoor.Win32.Lotok?


File Info:

crc32: 9D55A49F
md5: 6a0a4561d9323de227fc1bac6443bd19
name: 6A0A4561D9323DE227FC1BAC6443BD19.mlw
sha1: e5c666d322d04d6416f9478a73a1c4a939a203fb
sha256: 3ddd71c2c22b2fbe489c28c6fabd1e16f038396f4d020bb07c4c0208edd9c986
sha512: d440bde211f31858e01c0a4bfcd33612c2facb9a0d54d5b62bdf907a64217355c4fd3dfd829ac4606c624ed07425f65869972bad99b576a68868c669a753eb34
ssdeep: 12288:OCVN0qnQzx8dTjCxTk+fzNYxcGLwQhaAgi6I3oZjsqBD2Ua227thG6uNALkAK5sC:OLq88d34Wlw9Ar6IHq14GEK5slrUz
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2004
InternalName: test06
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: test06 Application
ProductVersion: 1, 0, 0, 1
FileDescription: test06 MFC Application
OriginalFilename: test06.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Lotok also known as:

CynetMalicious (score: 85)
CylanceUnsafe
CrowdStrikewin/malicious_confidence_60% (W)
AlibabaBackdoor:Win32/Lotok.0ff1edb5
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Malware.Gh0stRAT-7459730-1
KasperskyHEUR:Backdoor.Win32.Lotok.gen
ComodoTrojWare.Win32.Kryptik.BHFS@56cp6y
BitDefenderThetaGen:NN.ZexaCO.34670.xz1@amJ0Uxai
McAfee-GW-EditionGenericRXOC-KX!6A0A4561D932
AviraTR/AD.Farfli.kjtmn
eGambitUnsafe.AI_Score_73%
MicrosoftProgram:Win32/Wacapew.C!ml
AegisLabTrojan.Win32.Lotok.m!c
McAfeeGenericRXOC-KX!6A0A4561D932
MalwarebytesMalware.AI.1355446094
TrendMicro-HouseCallTROJ_GEN.R06CH06CU21
RisingBackdoor.Lotok!8.111D5 (CLOUD)
FortinetW32/Lotok!tr.bdr
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/Backdoor.Farfli.HwIAWNsA

How to remove Backdoor.Win32.Lotok?

Backdoor.Win32.Lotok removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment