Trojan-Banker.Win32.RTM.hlv information

The Trojan-Banker.Win32.RTM.hlv is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.hlv virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Banker.Win32.RTM.hlv?


File Info:
crc32: 8DD804C2
md5: 57fe194ea2fed8a577cd1e12a0d0ef76
name: 57FE194EA2FED8A577CD1E12A0D0EF76.mlw
sha1: b986831c3319b5f8a0f97fd75acd22dbda920559
sha256: 582a45a9c7a59b1831b6e65598ff712c6b09bf99794c481da7a98b98541762fa
sha512: b2f875000ce9a3c74e8f7ca8ff7b6690d3010bbabc8b10df2147acc32b08cfbbb1c87903eda27fdd13b32541caff7da38f8c7a448f859c2c496250ea75910d73
ssdeep: 6144:8Z+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHdO:ykvIfnMs596S9O
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1998-2016 VMware, Inc.
InternalName: VGAuthService
FileVersion: 10.0.9.29038
CompanyName: VMware, Inc.
ProductName: VMware Workstation
ProductVersion: e.x.p build-4162394
FileDescription: VMware Guest Authentication Service
OriginalFilename: VGAuthService.exe
Translation: 0x0409 0x04b0

Trojan-Banker.Win32.RTM.hlv also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.583578
FireEye	Generic.mg.57fe194ea2fed8a5
ALYac	Gen:Variant.Razy.583578
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_60% (D)
K7GW	Spyware ( 0040f0131 )
K7AntiVirus	Spyware ( 0040f0131 )
Symantec	ML.Attribute.HighConfidence
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	Trojan-Banker.Win32.RTM.hlv
BitDefender	Gen:Variant.Razy.583578
Ad-Aware	Gen:Variant.Razy.583578
Sophos	ML/PE-A + Mal/EncPk-APV
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Razy.583578 (B)
GData	Gen:Variant.Razy.583578
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Arcabit	Trojan.Razy.D8E79A
ZoneAlarm	Trojan-Banker.Win32.RTM.hlv
Microsoft	Trojan:Win32/Qakbot.GA!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4283230
McAfee	GenericRXAA-AA!57FE194EA2FE
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Yakes
Malwarebytes	Trojan.Qbot
APEX	Malicious
ESET-NOD32	a variant of Win32/Kryptik.HILN
Rising	Trojan.Kryptik!8.8 (TFE:2:ItOo6ejRx2)
Fortinet	W32/Kryptik.DZZ!tr
BitDefenderTheta	Gen:NN.ZedlaF.34700.vw8@aSaXN6ji
AVG	Win32:MalwareX-gen [Trj]

How to remove Trojan-Banker.Win32.RTM.hlv?

Trojan-Banker.Win32.RTM.hlv removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Banker.Win32.RTM.hlv information