Backdoor:Win32/Kelihos removal guide

The Backdoor:Win32/Kelihos is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Kelihos virus can do?

• Executable code extraction
• Creates RWX memory
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Chinese (Simplified)
• Network activity detected but not expressed in API logs

How to determine Backdoor:Win32/Kelihos?

File Info:
crc32: 4A0E6BB0
md5: 214aa7bd1c6b7e9ddfc258586de73d87
name: 214AA7BD1C6B7E9DDFC258586DE73D87.mlw
sha1: f5de4500b40b73407976c89562deb4bef3bc7cb5
sha256: dc820863210893e1854deb8ad1d83582d0c8cba6bdc7b2d6d9a7fdf09778b65d
sha512: 73426ed8e319e213e82421604b04916466f0164339d38b6b948690e12b099072c9404bea9b40ef75d93e32fab5b46fade6b774e18cefdf282f9b2673fe735548
ssdeep: 12288:f9UYivQeAi2/dI8T0ahgjcJhkrkBp1hYQszEYUcaK5jnic7jOYZtecw8:f9jBi2/dT0dQJhFuoYU89iYecD
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright:  (C) 2002
InternalName: Personnel
FileVersion: 1, 0, 0, 1
CompanyName: 
SpecialBuildx500D: 
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: Personnel 
ProductVersion: 1, 0, 0, 1
FileDescription: Personnel 
OriginalFilenax906de: Personnel.EXE
Translation: 0x0407 0x04e2

Backdoor:Win32/Kelihos also known as:

How to remove Backdoor:Win32/Kelihos?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.