Rootkit.Win32.Vemptik.x malicious file

The Rootkit.Win32.Vemptik.x is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Rootkit.Win32.Vemptik.x virus can do?

• Executable code extraction
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Starts servers listening on 0.0.0.0:12201
• Expresses interest in specific running processes
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Uses Windows utilities for basic functionality
• Collects information about installed applications
• Creates a hidden or system file
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine Rootkit.Win32.Vemptik.x?

File Info:
crc32: 7423055A
md5: e4ed1723c12e6d82790642bfe5dad9da
name: heu_kms_win10.exe
sha1: d8a6acc0c5341a16146897104aa8f3cb8c0d38eb
sha256: a8ac4b9d970fd879088103588532d0aa3b7530ed8516fca1664a4aae7c86fb14
sha512: 10008fca38ea8f8c111e668fe0ea73582092286d84741dd1e51d758ecbe95b2ef2ebaf772d3330a567684b562e23a246f66789227c805d754b69f612a381d454
ssdeep: 98304:VUJ4Dp+pWVzkEvLj0vvi4WMkWfY1wuCoi88xrGDoVWK5I45FWmsXEL17Mq2Sr/y:+JQjF0SWf/uCoGzWiI/5EpT2SrDDVih
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Copyright xa9 2014
FileVersion: 1.0
ProductVersion: 3.3.8.0
Translation: 0x0804 0x04b0

Rootkit.Win32.Vemptik.x also known as:

How to remove Rootkit.Win32.Vemptik.x?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.