Categories: Spy

Spyware.TelegramBot.TOR removal

The Spyware.TelegramBot.TOR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Spyware.TelegramBot.TOR virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Installs itself for autorun at Windows startup
  • Network activity detected but not expressed in API logs
  • Creates a copy of itself

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Spyware.TelegramBot.TOR?


File Info:

crc32: A14E7AE6md5: f449d3f3c434c96213d1f651557e205bname: upload_filesha1: 3f7c8306488c293d5fbef63ec91ccdafa6f635d7sha256: 70a78874a8666e2017aaae65cf7335453961385da28b156daa5327a880b20097sha512: 1e855227b3b189a7d8a3ca90a8e30a577673130a6580f2e25a2560f4fc8472178522d4582aa066d2b19074ab579be840bddfac7bc239d171460e71d9bd5cae39ssdeep: 24576:aAHnh+eWsN3skA4RV1Hom2KXMmHa9ZS+2lNCqMYeXO38x9gDvj5:th+ZkldoPK8Ya9Zp2KYZ8gJtype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: RAVBg64CompanyName: ProductName: ActivationManagerProductVersion: 473,586,363,916FileDescription: odbcconfOriginalFilename: blbres.exeTranslation: 0x0000 0x04b0

Spyware.TelegramBot.TOR also known as:

Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.Inject4.3033
MicroWorld-eScan Trojan.GenericKD.44061917
CAT-QuickHeal Trojan.Script
McAfee Artemis!F449D3F3C434
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
CrowdStrike win/malicious_confidence_90% (W)
BitDefender Trojan.GenericKD.44061917
K7GW Trojan ( 700000111 )
K7AntiVirus Trojan ( 700000111 )
Invincea Mal/Generic-S
Cyren W32/AutoIt.TB.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Script.Generic
Alibaba Trojan:Win32/AutoitU.ali2000008
ViRobot Trojan.Win32.Z.Wacatac.1277440
Rising Trojan.Obfus/Autoit!1.C6C8 (CLASSIC)
Ad-Aware Trojan.GenericKD.44061917
Emsisoft Trojan.GenericKD.44061917 (B)
F-Secure Trojan.TR/AutoIt.oytkn
TrendMicro Trojan.Win32.WACATAC.USMANJD20
McAfee-GW-Edition BehavesLike.Win32.TrojanAitInject.tc
FireEye Generic.mg.f449d3f3c434c962
Sophos Mal/Generic-S
Avira TR/AutoIt.oytkn
MAX malware (ai score=80)
Antiy-AVL GrayWare/Autoit.BinToStr.a
Microsoft Trojan:Win32/Predator.AR!MTB
Arcabit Trojan.Generic.D2A054DD
ZoneAlarm HEUR:Trojan.Script.Generic
GData Trojan.GenericKD.44061917
Cynet Malicious (score: 85)
VBA32 Trojan.Wacatac
ALYac Trojan.GenericKD.44061917
Malwarebytes Spyware.TelegramBot.TOR
Panda Trj/Genetic.gen
ESET-NOD32 a variant of Win32/Injector.Autoit.FKE
TrendMicro-HouseCall Trojan.Win32.WACATAC.USMANJD20
Ikarus Trojan-Spy.HawkEye
eGambit Unsafe.AI_Score_98%
Fortinet AutoIt/Injector.FKE!tr
AVG Win32:Trojan-gen
Cybereason malicious.6488c2
Avast Win32:Trojan-gen
Qihoo-360 Generic/Trojan.Script.ed4

How to remove Spyware.TelegramBot.TOR?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

How to remove “UDS:Trojan-Downloader.JS.SLoad”?

The UDS:Trojan-Downloader.JS.SLoad is considered dangerous by lots of security experts. When this infection is active,…

22 mins ago

What is “Malware.AI.521121088”?

The Malware.AI.521121088 is considered dangerous by lots of security experts. When this infection is active,…

49 mins ago

How to remove “Worm:Win32/Korgo.V”?

The Worm:Win32/Korgo.V is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Worm.Win32.Vobfus.dlcn (file analysis)

The Worm.Win32.Vobfus.dlcn is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Win32/Adware.InternetAntivirus removal instruction

The Win32/Adware.InternetAntivirus is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

TrojanDownloader:Win32/Unruy.A removal instruction

The TrojanDownloader:Win32/Unruy.A is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago