Backdoor:Win32/Rbot!G removal tips

The Backdoor:Win32/Rbot!G is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Rbot!G virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine Backdoor:Win32/Rbot!G?

File Info:
name: 77B27835838EDAD15E77.mlw
path: /opt/CAPEv2/storage/binaries/9ce613f8dd7b9eab4460f030d0df0735db8e4a39b85909ebe8cfd609e7830996
crc32: 2255B3B1
md5: 77b27835838edad15e7761092770e920
sha1: e16158ef1ee82b632b68d5c65266e5d6d7c54160
sha256: 9ce613f8dd7b9eab4460f030d0df0735db8e4a39b85909ebe8cfd609e7830996
sha512: 70b7a6f3ecef271e49879efe058418c795f80c17a8ed37d5d06f32f828327de0e8de21ee691b5be52592578da9aec1bd9668cc19f38165f172854b86aaa1cd70
ssdeep: 6144:L/2pVA9uGsSvUXBFuH3Y5zByJnMgbHSzFdBLOl+KpdBWVAf:D2pVcZjvUX+w/zFrOlrHWuf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14B34022171A6C433E92954355CB4D1612A7BAC525E30154B3FEC3B3EBFB02D09B267B6
sha3_384: 33794104cb2435bc385b6340276695addb41a394e7bb5b5748a807506e14cf58d92665faa0100d146c86ba4b33fc800b
ep_bytes: e8f51b0000e995feffff3b0d50d04000
timestamp: 2013-08-15 15:09:34

Version Info:
0: [No Data]

Backdoor:Win32/Rbot!G also known as:

How to remove Backdoor:Win32/Rbot!G?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.