Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Backdoor
Threat report

Backdoor:Win32/Lanfiltrator.P removal instruction

Published May 2, 2024 Backdoor category 3 min read
Report context

What to verify before removal

Backdoor:Win32/Lanfiltrator.P removal instruction deserves a credential-safety review because this backdoor label can overlap with remote access, browser data theft, or persistence after reboot. Cleanup should include scanning the file, removing the persistence point, and rotating exposed passwords from a clean device.

Start by comparing the local file name with E7D533C276C664FD92E6.mlw, then review the behavior notes for credential theft, browser data access, remote-control activity, and persistence after reboot. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
E7D533C276C664FD92E6.mlw
  • Compare the suspicious file name with E7D533C276C664FD92E6.mlw.
  • Confirm the detection name matches Backdoor:Win32/Lanfiltrator.P removal instruction before removing related files.
  • Review the report for credential theft, browser data access, remote-control activity, and persistence after reboot so the cleanup is based on observed behavior, not only the label.
  • After cleanup, rotate passwords from a clean device and review browser sessions or saved credentials.

The Backdoor:Win32/Lanfiltrator.P is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Backdoor:Win32/Lanfiltrator.P virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine Backdoor:Win32/Lanfiltrator.P?



File Info:

name: E7D533C276C664FD92E6.mlw
path: /opt/CAPEv2/storage/binaries/51a8a211e5662e8fd4029b89d44720100f2bbb5deab3c2e62ff917249afec412
crc32: 7A643550
md5: e7d533c276c664fd92e6c5d0a00badd8
sha1: 14eae18a40dbfdd8961d2ce005d59d7f097f88c6
sha256: 51a8a211e5662e8fd4029b89d44720100f2bbb5deab3c2e62ff917249afec412
sha512: f7e176a923c2d01520d9f887266922fd1da93c7538887c224ad865638cb6c8d451a349899c82a681c7ed47f0ddc206f56e84e4140c206c176225bda0c9e4938e
ssdeep: 12288:sKwZ75AdVxALIrEDpWxtvUmUSVeS0uPwXOZuoVrCWQLfLQx:s3+VKXPmU7S0owXOZ52WQjQx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T181D47E66BE819937C8F21A385C97A3F49827BE101D3825437BE71F0C8E397657F19286
sha3_384: d8c4aa9f5a8711eae49bf1ddb04f9a412f1b38c364dee559ceda8d22fb952357f2bbcd066bdbf6e6696214e69d94c154
ep_bytes: 558bec83c4f4b818324800e8e832f8ff
timestamp: 1992-06-19 22:22:17


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Generic Host Process for Win32 Services
FileVersion: 5.0.2134.1
InternalName: svchost.exe
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
LegalTrademarks: 
OriginalFilename: svchost.exe
ProductName: Microsoft(R) Windows (R) 2000 Operating System
ProductVersion: 5.00.2134.1
Translation: 0x0409 0x04e4

Backdoor:Win32/Lanfiltrator.P also known as:

Lionic Trojan.Win32.LanFiltrator.m!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Trojan.AV-Killer.LG0@aGVQgqbi
CMC Generic.Win32.e7d533c276!MD
Skyhigh BehavesLike.Win32.Dropper.hh
McAfee BackDoor-ANC
Malwarebytes LanFiltrator.Backdoor.RAT.DDS
Zillya Backdoor.LanFiltrator.Win32.53
Sangfor Trojan.Win32.Save.a
Alibaba Trojan:Win32/AntiAV.c78cefde
K7GW Trojan ( 000020d71 )
K7AntiVirus Trojan ( 000020d71 )
Arcabit Trojan.AV-Killer.EDC60C
VirIT Backdoor.Lanfiltrator.11.A
Symantec Backdoor.Lanfilt.B
ESET-NOD32 Win32/LanFiltrator.11
TrendMicro-HouseCall BKDR_LANFILTRA.I
Paloalto generic.ml
ClamAV Win.Trojan.Killav-81
Kaspersky HEUR:Trojan-Spy.Win32.KeyLogger.gen
BitDefender Gen:Trojan.AV-Killer.LG0@aGVQgqbi
NANO-Antivirus Trojan.Win32.LanFiltrator.dizs
Avast Win32:KillAV-XB [Trj]
Tencent Malware.Win32.Gencirc.13b0f867
Emsisoft Gen:Trojan.AV-Killer.LG0@aGVQgqbi (B)
Google Detected
F-Secure Backdoor.BDS/LANFilt.11.Srv
DrWeb BackDoor.Lanfilt.10
VIPRE Gen:Trojan.AV-Killer.LG0@aGVQgqbi
TrendMicro BKDR_LANFILTRA.I
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.e7d533c276c664fd
Sophos Troj/Bnksa-Fam
SentinelOne Static AI – Suspicious PE
Jiangmin Backdoor/LANFiltrator.11
Webroot W32.Backdoor.Gen
Varist W32/Hupigon.E.gen!Eldorado
Avira BDS/LANFilt.11.Srv
MAX malware (ai score=100)
Antiy-AVL Trojan[Backdoor]/Win32.LanFiltrator
Kingsoft Win32.Troj.Unknown.a
Xcitium Backdoor.Win32.LanFiltrator.11@45×0
Microsoft Backdoor:Win32/Lanfiltrator.P
ZoneAlarm HEUR:Trojan-Spy.Win32.KeyLogger.gen
GData Gen:Trojan.AV-Killer.LG0@aGVQgqbi
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Lanfiltrator.R159077
VBA32 TScope.Trojan.Delf
ALYac Gen:Trojan.AV-Killer.LG0@aGVQgqbi
Cylance unsafe
Panda Bck/LanFiltrator
Rising Trojan.KillAV!1.66BF (CLASSIC)
Yandex Trojan.GenAsa!SEwAcTixW00
Ikarus Backdoor.Win32.LanFiltrator
MaxSecure Trojan.Malware.1178958.susgen
Fortinet W32/Bdoor.ANC!tr.bdr
BitDefenderTheta AI:Packer.DD8A33111D
AVG Win32:KillAV-XB [Trj]
DeepInstinct MALICIOUS
alibabacloud Trojan:Win/LanFiltrator

How to remove Backdoor:Win32/Lanfiltrator.P?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.