How to remove “Backdoor:Win32/Rustock.E”?

The Backdoor:Win32/Rustock.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Rustock.E virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Backdoor:Win32/Rustock.E?

File Info:
name: 2C4A549D2919292FFBD5.mlw
path: /opt/CAPEv2/storage/binaries/924b6f0295bea16aa2e6a2f8feb66907d17f423bb24771385c5f51222b475c26
crc32: 2463C7FD
md5: 2c4a549d2919292ffbd579dedbd35771
sha1: e3667ac4945dd7bc7c63075f3cc694c671ea9955
sha256: 924b6f0295bea16aa2e6a2f8feb66907d17f423bb24771385c5f51222b475c26
sha512: 112fdd977d3f1cc1625151b4c5e175ace14455f8b0dd8efc856de6329a80cac7fd9746775f731076e37b3ba3c2b98a9fd8bdd2215fb6c00397278b2bd5f9caaf
ssdeep: 1536:uXLsRZCbc2n8PFC66wq+R0NKDHoTAJKb4C+sHICQvH0DCAYv4v/u:uYRZ+cXPc6zq+RM0oTALD6CH0DCJX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CA83E0D27A988AD3E1D31D386426F2165DF4F9E20A288A354488F53F2E837D58B3C775
sha3_384: 11abf0baa246ab4e22f6f280e3ce6110142f01904e34a6bf52fb3aeeeca6aa57710b1770bf346311eab8547ba2f5072e
ep_bytes: c745f8640000008365fc00e90f000000
timestamp: 1970-01-01 00:00:00

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Registry Editor Utility
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: regedt32.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: regedt32.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Backdoor:Win32/Rustock.E also known as:

How to remove Backdoor:Win32/Rustock.E?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.