What is "Trojan-Banker.Win32.RTM.fwp"?

The Trojan-Banker.Win32.RTM.fwp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.fwp virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Banker.Win32.RTM.fwp?


File Info:
crc32: 735A90F6
md5: d390673950cd049f645b081c2929a277
name: D390673950CD049F645B081C2929A277.mlw
sha1: ade9f6c01aac6700390008661a21329c503f7880
sha256: 7d6d9ec560bf6868976a3362fcbfca30baab91a69ddcebb01899ccc66a009106
sha512: 2ec4f9c4531a1cdf0c952f4f4674f0967d212572f4987a95f2370e97972bfedd93bfcb5ed9a8e439d82a7efd412a7875dbc1606bad9286529454cf7ef0134f2e
ssdeep: 6144:qju221F3vwlGw75yFFz0xo56Kb8iVKQnPQ7bV2qt6:/4HVyFFzr5bS6
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: vbc.exe
FileVersion: 8.0.50727.5420
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Visual Studioxae 2005
ProductVersion: 8.0.50727.5420
FileDescription: Visual Basic Command Line Compiler
OriginalFilename: vbc.exe
Translation: 0x0409 0x04b0

Trojan-Banker.Win32.RTM.fwp also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	BackDoor.Qbot.550
MicroWorld-eScan	Trojan.GenericKDZ.71946
FireEye	Generic.mg.d390673950cd049f
ALYac	Trojan.Agent.FAPM
Malwarebytes	Trojan.Qbot
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.GenericKDZ.71946
K7GW	Backdoor ( 00573a651 )
K7AntiVirus	Backdoor ( 00573a651 )
BitDefenderTheta	Gen:NN.ZedlaF.34700.n!8@a8PrfTci
Cyren	W32/Kryptik.CSQ.gen!Eldorado
APEX	Malicious
Kaspersky	Trojan-Banker.Win32.RTM.fwp
Ad-Aware	Trojan.GenericKDZ.71946
Sophos	ML/PE-A + Mal/EncPk-APV
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKDZ.71946 (B)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qakbot.ZX!MTB
Gridinsoft	Malware.Win32.Pack.61581!se
Arcabit	Trojan.Generic.D1190A
ZoneAlarm	Trojan-Banker.Win32.RTM.fwp
GData	Trojan.GenericKDZ.71946
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R358128
McAfee	W32/PinkSbot-HJ!D390673950CD
MAX	malware (ai score=81)
Cylance	Unsafe
ESET-NOD32	Win32/Qbot.CU
Rising	Trojan.Kryptik!1.CFFC (CLASSIC)
Yandex	Trojan.PWS.RTM!NaQJzYXWyI0
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Kryptik.HDNN!tr
Paloalto	generic.ml

How to remove Trojan-Banker.Win32.RTM.fwp?

Trojan-Banker.Win32.RTM.fwp removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Trojan-Banker.Win32.RTM.fwp”?