Backdoor:Win32/Votwup.C removal instruction

The Backdoor:Win32/Votwup.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Votwup.C virus can do?

Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Backdoor:Win32/Votwup.C?


File Info:
name: 533A50E0C30766890051.mlw
path: /opt/CAPEv2/storage/binaries/c32f13feb7a598cb62f45b8dbf7ebc7cf5f6767429fc18c2f83dd5e82a63c2ac
crc32: D0A5278A
md5: 533a50e0c30766890051552c7368d67e
sha1: ad5432da27a53a7843fa8180706471ac48544767
sha256: c32f13feb7a598cb62f45b8dbf7ebc7cf5f6767429fc18c2f83dd5e82a63c2ac
sha512: 828c15b6ed7590925d6758618e5b05bd5ff1e2bf22ee2b03efbe4dbcd427435f8aaba8cf631dc8db39453251531146e05c83e6df5ce84540adfb35ca597aadec
ssdeep: 1536:tvsEClKJIU3dvDlP5KgsDICES57zqcP5+VUkCXTuzPH2R+rY63VMBC:t3C0iSdvBUDMS8wXjuzPLYKG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15764A0305B580123F7A46534BBFB3103E0E9FAB718DC40147046EECD52A6E9A6DAB75E
sha3_384: 83e04f0d9e40059008df107f6af4aede2e319f0d092cdb75937066669ba04fe8783b7c19027f85c95bda845568a1513e
ep_bytes: 558bec81c49cfefffff7de5068fc69c3
timestamp: 2008-11-14 07:42:13

Version Info:
CompanyName: ыгюШжжуБИЭтУпдЬкхкнРУЯЬНРцу
FileDescription: НЩглврпЦэЕЪХбъстлуЬПЯЕО
FileVersion: 102.39.117.1
InternalName: яеЯАРЧЖБнльУдщЩТГшвЭЩЛХоШрэ
LegalCopyright: 5106-9678
OriginalFilename: c8OPR8iB.exe
ProductName: ЯРзУърОцУчЖВшЪщШхвЫщъааэСЯ
ProductVersion: 102.39.117.1
Translation: 0x04b0 0x0417

Backdoor:Win32/Votwup.C also known as:

Lionic	Virus.Win32.Virut.mDTC
Elastic	malicious (high confidence)
DrWeb	Trojan.Packed.20343
MicroWorld-eScan	Gen:Variant.Fugrafa.9026
FireEye	Generic.mg.533a50e0c3076689
ALYac	Gen:Variant.Fugrafa.9026
Cylance	Unsafe
VIPRE	Trojan.Win32.Nedsym.f (v)
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	Backdoor:Win32/Votwup.e4ec748d
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.0c3076
BitDefenderTheta	Gen:NN.ZexaF.34232.tm2@aaMgDHac
VirIT	Trojan.Win32.SHeur3.ADTU
Cyren	W32/Qakbot.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Votwup.I
TrendMicro-HouseCall	WORM_QAKBOT.SMB
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Packed.Win32.Krap.hm
BitDefender	Gen:Variant.Fugrafa.9026
NANO-Antivirus	Trojan.Win32.Krap.cclxg
Avast	Win32:Malware-gen
Ad-Aware	Gen:Variant.Fugrafa.9026
Sophos	Mal/Generic-R + Mal/EncPk-ZC
Comodo	MalCrypt.Indus!@1qrzi1
Zillya	Downloader.Agent.Win32.95512
TrendMicro	WORM_QAKBOT.SMB
McAfee-GW-Edition	BehavesLike.Win32.Downloader.fz
Emsisoft	Gen:Variant.Fugrafa.9026 (B)
Ikarus	Trojan.Zlob
Avira	TR/Crypt.ZPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.576BA6
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	Backdoor:Win32/Votwup.C
ViRobot	Trojan.Win32.A.Downloader.322048.B
GData	Gen:Variant.Fugrafa.9026
SentinelOne	Static AI – Malicious PE
Acronis	suspicious
McAfee	PWS-Zbot.gen.aum
VBA32	BScope.TrojanPSW.Papras
APEX	Malicious
Tencent	Win32.Packed.Krap.Stao
Yandex	Trojan.GenAsa!P7vCeZbLOg8
MAX	malware (ai score=100)
eGambit	Generic.Malware
Fortinet	W32/Krypt.A!tr.dldr
AVG	Win32:Malware-gen
Panda	Trj/Sinowal.XEG
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Backdoor:Win32/Votwup.C?

Backdoor:Win32/Votwup.C removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X