Backdoor

Backdoor:PHP/Webshell.PA!MSR removal instruction

Malware Removal

The Backdoor:PHP/Webshell.PA!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:PHP/Webshell.PA!MSR virus can do?

  • Creates a hidden or system file
  • Network activity detected but not expressed in API logs

How to determine Backdoor:PHP/Webshell.PA!MSR?


File Info:

crc32: 8E973E10
md5: a7325beb50c9daacdf18a3af15869304
name: upload_file
sha1: dfda4d67494e299ebbf6dabdf89721799f03c8b9
sha256: f17ca50c1f16ca20f3d71bcd40c3bb9e3ef9c11b53c7c7458d29c1e1fe272827
sha512: 82c43ae2ca7a63eeb2154b240e16fcd7fe1ea12be17e1c3504a51f0579daad5bd0b973398c277d62728007d5e09a3a4aa546cce2d7890ed41a58fbb858d65573
ssdeep: 1536:9K/6lvAf45hUisxYtbEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEaEEEEEEEEEEEEEEo:9KIXh1UYnZraRDAw5wfB
type: Rich Text Format data, version 1, unknown character set

Version Info:

0: [No Data]

Backdoor:PHP/Webshell.PA!MSR also known as:

CAT-QuickHealExp.RTF.CVE-2017-8570.A
SangforMalware
CyrenCVE178570
SymantecW97M.Downloader
TrendMicro-HouseCallPossible_SMBCVE20170199
AvastRTF:Agent-H [Trj]
KasperskyHEUR:Trojan-Downloader.Script.Generic
DrWebExploit.Siggen2.15815
TrendMicroHEUR_RTFMALFORM
IkarusWin32.Outbreak
F-ProtCVE178570
FortinetVBS/Agent.71C2!tr
ZoneAlarmHEUR:Exploit.MSOffice.Generic
MicrosoftBackdoor:PHP/Webshell.PA!MSR
AhnLab-V3Exploit/RTF.Generic.S1253
TACHYONSuspicious/RTF.Script.Gen
ZonerProbably Heur.RTFObfuscationD
ESET-NOD32RTF/Agent.A
RisingExploit.CVE-2017-8570!1.AFC6 (CLASSIC)
AVGRTF:Agent-H [Trj]
Qihoo-360heur.rtf.obfuscated.1

How to remove Backdoor:PHP/Webshell.PA!MSR?

Backdoor:PHP/Webshell.PA!MSR removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment