Backdoor:Win32/Qakbot.H removal guide

The Backdoor:Win32/Qakbot.H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Qakbot.H virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Backdoor:Win32/Qakbot.H?

File Info:
name: 589BD48F8E5224C595E6.mlw
path: /opt/CAPEv2/storage/binaries/0e409f764f1a2cb9a4c5de1dbbd5b0e704561dd0d0a1e7556f020f9575901022
crc32: B49164F6
md5: 589bd48f8e5224c595e6a231c80928ea
sha1: 6bb7fe2b0547f227edbd5c21c5a9a755d2dd39ae
sha256: 0e409f764f1a2cb9a4c5de1dbbd5b0e704561dd0d0a1e7556f020f9575901022
sha512: d2550b63919f66d60df5361f85b5d161fcbf1309d002722476db3e304d1d648167194d7b5f9a366196d88f009f7ceb9a51c0b9e4040d70d6f9dede216b9bf92f
ssdeep: 6144:K0pJvMAM7zGZOfU5DqwSlgitpxjL4j/sacth7PRn4SP:K03RMeg0DJcjdLUoxKm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AE441270868069BDF1C5CA364701A3D898F6B0C36C3F56AD51B5AAF27425F70BA2C367
sha3_384: ddf5302656499372d1a849f0ec191d257e4709b7e16afe58bb587285e1a6fcd1bf077d85465a8debbf52d8d536cff3cd
ep_bytes: 60be001041008dbe0000ffff57eb0b90
timestamp: 2005-09-23 11:20:17

Version Info:
CompanyName: Dweyii Mjjhuhbb
FileDescription: Dweyii Ynmbimukrg Dsonejqhcf
FileVersion: 15
InternalName: Dweyii
LegalCopyright: Copyright © Dweyii Mjjhuhbb 1999-2008
OriginalFilename: Dweyii.exe
ProductName: Dweyii Ynmbimukrg Dsonejqhcf
ProductVersion: 86.28
Translation: 0x0409 0x04b0

Backdoor:Win32/Qakbot.H also known as:

How to remove Backdoor:Win32/Qakbot.H?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.