About "Backdoor.Win32.Remcos.nww" infection

The Backdoor.Win32.Remcos.nww is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Remcos.nww virus can do?

Executable code extraction
Creates RWX memory
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Remcos.nww?


File Info:
crc32: 60E7BCBB
md5: 9a84e2cd1c1d2d0d16fe18192e92bf37
name: henstandens.exe
sha1: a531144055bd20ab22ec1990ea47dededf09bea6
sha256: 67a440e4321d89d7137b08ebcdbfe5887fe280734336df4c4cd224d523c83f68
sha512: 620a56c9836583e76c2fe10e0f03c7f4617d1671ec5b3ec93e671b8ab9786b5e4b5de6282280c46f01bc2c1c13bf06aceaf52afcbbe33ebf81c8b6f4c2ee96cb
ssdeep: 768:/eqMzzL6vMxtvtQQt9DmvFYPYfq6qjH3hgDHcGM/4VFqp38H:/eDz6v21QQ/DmdvyjH3zCFquH
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
InternalName: hoopoo
FileVersion: 1.00.0002
CompanyName: Klagesagsbehandlings5
ProductName: Peroses
ProductVersion: 1.00.0002
FileDescription: Trippevalsen
OriginalFilename: hoopoo.exe

Backdoor.Win32.Remcos.nww also known as:

DrWeb	Trojan.DownLoader33.21651
MicroWorld-eScan	Trojan.GenericKD.42892863
McAfee	Artemis!9A84E2CD1C1D
Malwarebytes	Trojan.GuLoader.VB
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 0055f76e1 )
BitDefender	Trojan.GenericKD.42892863
K7GW	Trojan-Downloader ( 0055f76e1 )
Arcabit	Trojan.Generic.D28E7E3F
TrendMicro	TROJ_GEN.R011C0DCR20
BitDefenderTheta	Gen:NN.ZevbaF.34104.gm0@aaiKD3di
Cyren	W32/VBKrypt.AGG.gen!Eldorado
ESET-NOD32	Win32/TrojanDownloader.Agent.EYK
APEX	Malicious
Kaspersky	Backdoor.Win32.Remcos.nww
Alibaba	Trojan:Win32/vbcrypt.ali2000008
Rising	Backdoor.Remcos!8.B89E (CLOUD)
Emsisoft	Trojan.GenericKD.42892863 (B)
F-Secure	Trojan.TR/Dldr.Agent.ssovj
McAfee-GW-Edition	RDN/Generic Downloader.x
Fortinet	W32/GuLoader.VHHZ!tr
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
F-Prot	W32/VBKrypt.AGG.gen!Eldorado
Webroot	W32.Trojan.Gen
Avira	TR/Dldr.Agent.ssovj
Antiy-AVL	Trojan/Win32.Azden
Microsoft	Trojan:Win32/Dynamer!rfn
ZoneAlarm	Backdoor.Win32.Remcos.nww
ALYac	Trojan.GenericKD.42892863
Ad-Aware	Trojan.GenericKD.42892863
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R011C0DCR20
Tencent	Win32.Backdoor.Remcos.Hviy
Ikarus	Trojan-Downloader.Win32.Agent
GData	Win32.Trojan-Downloader.Dagurleo.S0AP52
AVG	Win32:DropperX-gen [Drp]
Avast	Win32:DropperX-gen [Drp]
Qihoo-360	Win32/Backdoor.968

How to remove Backdoor.Win32.Remcos.nww?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Backdoor.Win32.Remcos.nww” infection