Backdoor.Win32.Mokes.alrj removal tips

The Backdoor.Win32.Mokes.alrj is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Mokes.alrj virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Unconventionial language used in binary resources: Norwegian (Nynorsk)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Executed a process and injected code into it, probably while unpacking
Detects Sandboxie through the presence of a library
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Mokes.alrj?


File Info:
crc32: D17EEDBF
md5: 384fdd7f4988494ec72aa9ff7e509d58
name: 384FDD7F4988494EC72AA9FF7E509D58.mlw
sha1: dc107fa3b4a5c6d29ef9531d4a1f0045815117e2
sha256: f63a822f5d43f61c35fb7eaac946252550bfde5e7992c8cfc2b14c75016fced9
sha512: 1cd2d0e1a0b43e511ada908f357417f16580372411f413194371ac3fc05c5304fa599f29a69c95cc78cfeeb68fe8f9004c0628fed76ef6a436fe0f70573002e4
ssdeep: 3072:uP1k0cwQXkgkSXer4a9WvrDJ/Sdo+WPfnGirzBHDlhH:uPaKgkVroTDxNQOBjrH
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalName: triwilbifor.acs
FileVersion: 6.26.361
Copyright: Copyrighz (C) 2020, vodkafuck
ProductVersion: 1.0.15
TranslationUsa: 0x0273 0x053a

Backdoor.Win32.Mokes.alrj also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen11.57100
MicroWorld-eScan	Trojan.GenericKD.35967643
FireEye	Generic.mg.384fdd7f4988494e
McAfee	GenericRXAA-AA!384FDD7F4988
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.35967643
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZexaF.34742.nmKfa0k!ieaG
Cyren	W32/Trojan.WBNT-6646
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
Kaspersky	Backdoor.Win32.Mokes.alrj
Alibaba	Backdoor:Win32/Mokes.4355819f
AegisLab	Trojan.Win32.Malicious.4!c
Rising	Trojan.Kryptik!1.CFEE (CLASSIC)
Ad-Aware	Trojan.GenericKD.35967643
Emsisoft	Trojan.GenericKD.35967643 (B)
F-Secure	Trojan.TR/AD.SmokeLoader.paztv
TrendMicro	TROJ_GEN.R011C0DA521
McAfee-GW-Edition	BehavesLike.Win32.Trojan.dc
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Crypt
Avira	TR/AD.SmokeLoader.paztv
Microsoft	Trojan:Win32/Azorult.FW!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Generic.D224D29B
ZoneAlarm	Backdoor.Win32.Mokes.alrj
GData	Trojan.GenericKD.35967643
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Glupteba.R362043
ALYac	Trojan.GenericKD.35967643
MAX	malware (ai score=87)
VBA32	Trojan.Chapak
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HIMS
TrendMicro-HouseCall	TROJ_GEN.R011C0DA521
Tencent	Win32.Backdoor.Mokes.Ljkp
SentinelOne	Static AI – Malicious PE
Fortinet	W32/GenKryptik.DQNE!tr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.f49884
Paloalto	generic.ml
Qihoo-360	Generic/HEUR/QVM11.1.52C3.Malware.Gen

How to remove Backdoor.Win32.Mokes.alrj?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Mokes.alrj removal tips