Should I remove “Backdoor.XClient.Generic”?

The Backdoor.XClient.Generic is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.XClient.Generic virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Backdoor.XClient.Generic?


File Info:
name: 76A63AD2A1D79073E9DA.mlw
path: /opt/CAPEv2/storage/binaries/29dce07da4bc2561193bdea359a578bea129b026ff9ebbefe3d15f6ca399815f
crc32: F5C4AEDF
md5: 76a63ad2a1d79073e9da3bb937c1a803
sha1: c929d8ca7c7dbf3fafc86f93a0d9a2a9054ab2e3
sha256: 29dce07da4bc2561193bdea359a578bea129b026ff9ebbefe3d15f6ca399815f
sha512: 3e0033363880be6b8acb04ad8dedbe6461a31e1e46a07e3e06ee249c8796f6c6c11beaee54d279a1e33d105c8ab3ffedbd6ce8544598ebebeb05b5f93530afdc
ssdeep: 3072:yDBcKa3LdTsCTNEfBQhCnSF0enwHIafR8XXe:6BcFZhEp5Iafy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BDC3F214BFDCE71AC0B92B714D3AD9C2D26386DDB4823D55AB94B08DC4AD30DC2926F6
sha3_384: 2d0c5f720ef261b1c684e54e114f74bcfc0efd01e4bd9ea601b9f0e2ced2e094996e5064bba6d4ac3e9f154a16dd64b3
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-07-26 19:10:30

Version Info:
Translation: 0x0000 0x04b0
CompanyName: Cfx.re
FileDescription: FiveM
FileVersion: 2.0.0.6520
InternalName: script Fall.exe
LegalCopyright: (C) 2015-2022 Cfx.re
OriginalFilename: script Fall.exe
ProductName: FiveM
ProductVersion: 2.0.0.6520
Assembly Version: 2.0.0.6520

Backdoor.XClient.Generic also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.25637
FireEye	Generic.mg.76a63ad2a1d79073
ALYac	IL:Trojan.MSILZilla.25637
Malwarebytes	Backdoor.XClient.Generic
VIPRE	IL:Trojan.MSILZilla.25637
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.FPO
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Ransom.MSIL.Blocker.gen
BitDefender	IL:Trojan.MSILZilla.25637
Avast	Win32:PWSX-gen [Trj]
Emsisoft	IL:Trojan.MSILZilla.25637 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Siggen20.16909
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
Ikarus	Trojan.MSIL.Krypt
GData	IL:Trojan.MSILZilla.25637
Avira	TR/Dropper.Gen
Arcabit	IL:Trojan.MSILZilla.D6425
ZoneAlarm	HEUR:Trojan-Ransom.MSIL.Blocker.gen
Microsoft	Trojan:MSIL/AsyncRat.ABJU!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5381093
Acronis	suspicious
MAX	malware (ai score=88)
Cylance	unsafe
Rising	Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:o3dZPk618a7XIHMki78BSg)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Zilla.5637!tr
BitDefenderTheta	Gen:NN.ZemsilF.36318.hm0@a4GVnxd
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.a7c7db
DeepInstinct	MALICIOUS

How to remove Backdoor.XClient.Generic?

Backdoor.XClient.Generic removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X