How to remove "Trojan-Banker.Win32.RTM.gbg"?

The Trojan-Banker.Win32.RTM.gbg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.gbg virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Banker.Win32.RTM.gbg?


File Info:
crc32: D9AEE5A2
md5: c300a4f9d885116a4ebf30250dbda77e
name: C300A4F9D885116A4EBF30250DBDA77E.mlw
sha1: 921406e91672941b4931b943f4ca8607c929319a
sha256: 0cfd289b41e1849b6678823574bab07b730094bcbab4577ece3e96febe84d4d4
sha512: fa86df57e987eaf683c212be4357ffc61a021a937457ae13bb32c7816e3eac6f20e77488cd509cb36cba0f601d26b80a57de8be173a34edf496ab3ea6e446dcb
ssdeep: 3072:quIiJoHKY3QV4x6EhUFrcmrZSLD/L+O1avhuGJ1fAkjJBGZeWrhNF0lXt53/NeB:PIiJIKzEQrS7LZAJvBGZeWhYXXvNe4
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: appcmd.exe
FileVersion: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
ProductVersion: 7.5.7601.17514
FileDescription: Application Server Command Line Admin Tool
OriginalFilename: appcmd.exe
Translation: 0x0000 0x04b0

Trojan-Banker.Win32.RTM.gbg also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.71976
FireEye	Generic.mg.c300a4f9d885116a
McAfee	W32/PinkSbot-HJ!C300A4F9D885
AegisLab	Hacktool.Win32.Krap.lKMc
Sangfor	Malware
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKDZ.71976
K7GW	Spyware ( 0040f0131 )
CrowdStrike	win/malicious_confidence_100% (D)
Cyren	W32/Qbot.BK.gen!Eldorado
Symantec	Ransom.Wannacry
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Banker.Win32.RTM.gbg
Alibaba	TrojanBanker:Win32/Generic.d9e1959b
Rising	Trojan.Kryptik!1.CFFC (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.71976
Emsisoft	Trojan.Crypt (A)
Comodo	Malware@#2x53zzs6bawam
F-Secure	Trojan.TR/AD.Qbot.CS
DrWeb	BackDoor.Qbot.568
McAfee-GW-Edition	BehavesLike.Win32.Generic.vt
Sophos	ML/PE-A + Mal/EncPk-APV
Ikarus	Backdoor.QBot
Webroot	W32.Trojan.Gen
Avira	TR/AD.Qbot.CS
MAX	malware (ai score=86)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Qakbot.VAM!MTB
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Generic.D11928
ZoneAlarm	Trojan-Banker.Win32.RTM.gbg
GData	Trojan.GenericKDZ.71976
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4265195
BitDefenderTheta	Gen:NN.ZedlaF.34700.os8@aGb7u2hi
ALYac	Trojan.Agent.QakBot
Panda	Trj/Genetic.gen
ESET-NOD32	Win32/Qbot.CV
Tencent	Win32.Trojan.Razy.Sumy
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.HDNN!tr
AVG	Win32:BankerX-gen [Trj]
Avast	Win32:BankerX-gen [Trj]
Qihoo-360	Win32/Trojan.29b

How to remove Trojan-Banker.Win32.RTM.gbg?

Trojan-Banker.Win32.RTM.gbg removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

How to remove “Trojan-Banker.Win32.RTM.gbg”?