RemoteAdmin.Win32.WinVNC-based.lg malicious file

The RemoteAdmin.Win32.WinVNC-based.lg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What RemoteAdmin.Win32.WinVNC-based.lg virus can do?

• Executable code extraction
• Attempts to connect to a dead IP:Port (1 unique times)
• Creates RWX memory
• At least one IP Address, Domain, or File Name was found in a crypto call
• Reads data out of its own binary image
• Drops a binary and executes it
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• Anomalous binary characteristics

Related domains:

How to determine RemoteAdmin.Win32.WinVNC-based.lg?

File Info:
crc32: 1984FF14
md5: 4d7ae55383c08888036be3c72a2ee5da
name: suportedireto_setup.exe
sha1: 2a88599ea55bec87652d6fdc10b912f4181e16d3
sha256: a4ddb1dfc00486803d72f7d7aa477a69f3cd807cbe0e494b9cfa735de7301b93
sha512: aff2e821766291eaa1056ec78448fea4c1175b3fc60371ca900e1542c820de892cd55a18e7fde736832fe89bf8a751773a53a0c2bf9c0861ee9439dfdbad7677
ssdeep: 12288:Al9PCtxCui2jnTgRx3TwbYfyT/+Ic4t+84L1O7f81YgEUSqjW8vlVLZ:u52HgHsbmyT/+IFQ84L1Oo1gqjW8vfLZ
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
0: [No Data]

RemoteAdmin.Win32.WinVNC-based.lg also known as:

How to remove RemoteAdmin.Win32.WinVNC-based.lg?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.