Backdoor:Win32/Tofsee.I removal guide

The Backdoor:Win32/Tofsee.I is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Tofsee.I virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Backdoor:Win32/Tofsee.I?

File Info:
name: 632611CDFD69916E86D4.mlw
path: /opt/CAPEv2/storage/binaries/56d81e8c005960101685039db4ee9318073b2f2d7c3b3f6782f0f2d46cee118e
crc32: C8F21E4F
md5: 632611cdfd69916e86d4e96c3bbff82d
sha1: b0093a07703a959bda1db0daa1a155cea965fdd0
sha256: 56d81e8c005960101685039db4ee9318073b2f2d7c3b3f6782f0f2d46cee118e
sha512: a50745900f6abad9298aa80dbbc5d125db3a57751fcdd215e3931b50ed10fe802d2e94381b1f9624515ed300b0469c13a25a1115f537e976dc207b173e236b44
ssdeep: 768:P5jEDJtydVhHv176H797vJTfMCuWVBC/4xfH59QDOrEso5:PNEDJEpoHLLMCtEQxfZyDCe5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T103D2F15D7EB79437E14819383ACD02EBB207D88076CF4FA6DF541A2828D764FE89044E
sha3_384: 61d4ab5d626c4db2a778490e569d72adbf3039d5c8d736107d0c16ac8e1e6aab7662b675b7ab9a8cd56170ef7863a1b6
ep_bytes: 60be000041008dbe0010ffff5783cdff
timestamp: 2004-08-14 04:59:05

Version Info:
0: [No Data]

Backdoor:Win32/Tofsee.I also known as:

How to remove Backdoor:Win32/Tofsee.I?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.