How to remove “Backdoor:Win32/Xtrat.AC”?

The Backdoor:Win32/Xtrat.AC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Xtrat.AC virus can do?

• Executable code extraction
• Injection (inter-process)
• Injection (Process Hollowing)
• Injection with CreateRemoteThread in a remote process
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Reads data out of its own binary image
• Executed a process and injected code into it, probably while unpacking
• Code injection with CreateRemoteThread in a remote process
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a copy of itself
• Creates a slightly modified copy of itself
• Creates known XtremeRAT mutexes

Related domains:

How to determine Backdoor:Win32/Xtrat.AC?

File Info:
crc32: B54AE422
md5: 0394db81257ce589a1019605c93cdf80
name: ENTREGA-DE-SOPORTES-PAGO-PSE-REALIADO-EXITOSAMENTE-IMG.AVW-2323425235-235235325232-5253257.exe
sha1: 7dbd22f4a77a1570c323c1954bbeea71a1da225c
sha256: 0e6464c8f4b60eff44a75b6c5f74efe1fa607fbd267d3ea80442f95f33625407
sha512: a17131611bf238b060383cff1760797f2144064de0ec98976579190f95bcc8717bb69657b0229a2150f81fbad6c0825f89c9c2cd9dd6e995fa7d7d44298cb5c6
ssdeep: 12288:Otb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaJjOLyOJSpq6A:Otb20pkaCqT5TBWgNQ7aZOXYpq6A
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0809 0x04b0

Backdoor:Win32/Xtrat.AC also known as:

How to remove Backdoor:Win32/Xtrat.AC?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.