BScope.Backdoor.Nethief removal

The BScope.Backdoor.Nethief is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What BScope.Backdoor.Nethief virus can do?

Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine BScope.Backdoor.Nethief?


File Info:
name: 13EE6B437B1E9703DB4F.mlw
path: /opt/CAPEv2/storage/binaries/f5fe255082e62d48a8bc48c833dfb0f88a89486547a65770e8ae2e484536d86c
crc32: 719DDE6A
md5: 13ee6b437b1e9703db4f8bdc8314a5f1
sha1: b65a8e433394f98e2eec780edc82cf72fce2ba86
sha256: f5fe255082e62d48a8bc48c833dfb0f88a89486547a65770e8ae2e484536d86c
sha512: 544faf649b6fcff24940f3636aca6b1d11cd1560d30a299796a9c60411cb344274ade410fd1986f1c1f51aed2e29a0ed433471993bd380e23406c034633466a7
ssdeep: 98304:IOgUhTh1E+Mn8xFtOEF/OBFOWVLeFoezFUORmusF87ExMMe10TwpC6MhV2dUc3oc:Zh11E+Mn8xFtOEF/OBFOWVLeFoezFUOz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CA365B13F471C168E191213079B9F9BDE16FEF85CBE54AC33284FE1819B74E5212AB1A
sha3_384: 472647c6e2b102aafacf59fd54511ec40f64564451c2b7ac44747ff7c8321c87622871bd4fa5603c1b8fdb5c2d9b22c6
ep_bytes: e9a84fe1ffe805000000e9f14fffff55
timestamp: 2008-07-05 23:13:04

Version Info:
Comments: MsgServer
CompanyName: MsgServer
FileDescription: 
FileVersion: 196
InternalName: MsgServer
LegalCopyright: 版权所有 (C) 2012
LegalTrademarks: 
OriginalFilename: MsgServer.EXE
PrivateBuild: 
ProductName: 魔域 服务器
ProductVersion: 1, 0, 0, 0
SpecialBuild: 1,0,0,0

BScope.Backdoor.Nethief also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Poison.kYJP
MicroWorld-eScan	Trojan.GenericKD.47586510
FireEye	Trojan.GenericKD.47586510
ALYac	Trojan.GenericKD.47586510
Cylance	Unsafe
Cybereason	malicious.33394f
APEX	Malicious
BitDefender	Trojan.GenericKD.47586510
Avast	FileRepMalware
Ad-Aware	Trojan.GenericKD.47586510
Emsisoft	Trojan.GenericKD.47586510 (B)
Sophos	Generic ML PUA (PUA)
GData	Trojan.GenericKD.47586510
Avira	HEUR/AGEN.1205280
Gridinsoft	Ransom.Win32.Sabsik.sa
Cynet	Malicious (score: 99)
McAfee	Artemis!13EE6B437B1E
MAX	malware (ai score=84)
VBA32	BScope.Backdoor.Nethief
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/PossibleThreat
BitDefenderTheta	Gen:NN.ZexaF.34062.@x1@ai5j3!kb
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_60% (W)

How to remove BScope.Backdoor.Nethief?

BScope.Backdoor.Nethief removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X