Backdoor:Win32/RDPopen.A removal

The Backdoor:Win32/RDPopen.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/RDPopen.A virus can do?

• Executable code extraction
• Injection (inter-process)
• Injection (Process Hollowing)
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Uses Windows utilities for basic functionality
• Executed a process and injected code into it, probably while unpacking
• Deletes its original binary from disk
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Installs itself for autorun at Windows startup
• Attempts to modify browser security settings
• Creates a copy of itself
• Attempts to disable browser security warnings
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Backdoor:Win32/RDPopen.A?

File Info:
crc32: 12074DB4
md5: 7e9d954e7c74d0d0a3a3094d68e8f841
name: 7E9D954E7C74D0D0A3A3094D68E8F841.mlw
sha1: cb1f10f9828a9bc8360e50db1ae0b1597e82755e
sha256: 015d78136a78063c8c9e8dfd346cc2d2a4fa60d769f72ddc1ebebbc789c51990
sha512: ae2d2c18f3fba5841f76fcef0e41f4ad7f8135cd04a4ce8cd87d334f1daa3c3983aec4c2e986f1f741e0ffc187140a7008b0777c369b19d2384095ec3d4e42f0
ssdeep: 3072:NaJmYHKPBM7oAuV5jBvg6goUf0zoPZirgxsY3S6orCBB/814GtUKjixzyF0:NYK5M7oAI5ZgjpftniiAC7lxxzy+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright 1994-2007 Mindjet LLC, U.S.A. All rights reserved.
InternalName: MindManager
FileVersion: 10.2.209
CompanyName: Mindjet
LegalTrademarks: MindManager is a registered trademark of Mindjet LLC.
Comments: MindManager 7
ProductName: MindManager
OLESelfRegister: 1
Edition: for Windows
ProductVersion: 10.2.209
FileDescription: Mindjet MindManager 2012
OriginalFilename: MindManager.exe
Translation: 0x0409 0x04b0

Backdoor:Win32/RDPopen.A also known as:

How to remove Backdoor:Win32/RDPopen.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.