Trojan-Banker.Win32.RTM.htz information

The Trojan-Banker.Win32.RTM.htz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.htz virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Banker.Win32.RTM.htz?


File Info:
crc32: 763A2FB0
md5: 18f59e472aa9eab4654e045bab9980dd
name: 18F59E472AA9EAB4654E045BAB9980DD.mlw
sha1: 756b7dbb6c9cd265b155999341bc0006f35bcda8
sha256: 637c58b932c768d1f0a0c3bfd0ae1c9e80173c0abed1d18d065b782e0b300417
sha512: 21851bbecf2db35af7290c6f0e4420661922015d4a25241bdbedb519d2f685fffe5d6faf8959382820ee44ce5b58c66345c56b127ed0c22293b1575d5e8d664f
ssdeep: 6144:Zvy+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHdTivy:gkvIfnMs596S9Tivy
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2016
InternalName: Java Control Panel
FileVersion: 11.121.2.13
Full Version: 11.121.2.13
CompanyName: Oracle Corporation
ProductName: Java(TM) Platform SE 8 U121
ProductVersion: 8.0.1210.13
FileDescription: Java Control Panel
OriginalFilename: javacpl.exe
Translation: 0x0409 0x04b0

Trojan-Banker.Win32.RTM.htz also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35937616
FireEye	Generic.mg.18f59e472aa9eab4
McAfee	GenericRXNE-LU!18F59E472AA9
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Trojan.GenericKD.35937616
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Cyren	W32/Trojan.NKFJ-3751
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Kaspersky	Trojan-Banker.Win32.RTM.htz
Alibaba	TrojanBanker:Win32/Kryptik.0425c857
AegisLab	Hacktool.Win32.Krap.lKMc
Rising	Malware.Obscure/Heur!1.A89E (CLASSIC)
Ad-Aware	Trojan.GenericKD.35937616
Sophos	Mal/Generic-R + Mal/EncPk-APV
F-Secure	Trojan.TR/Crypt.Agent.abkqg
DrWeb	Trojan.Inject4.6403
TrendMicro	TROJ_GEN.R002C0RLV20
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.35937616 (B)
Ikarus	Trojan.Win32.Crypt
Jiangmin	Trojan.Banker.RTM.vh
eGambit	Unsafe.AI_Score_95%
Avira	TR/Crypt.Agent.abkqg
MAX	malware (ai score=84)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Program:Win32/Ymacco.AA63
Gridinsoft	Trojan.Win32.Downloader.oa
Arcabit	Trojan.Generic.D2245D50
ZoneAlarm	Trojan-Banker.Win32.RTM.htz
GData	Trojan.GenericKD.35937616
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZedlaF.34700.ww8@aSbtfAhi
ALYac	Trojan.GenericKD.35937616
VBA32	BScope.Trojan.Diple
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.HILY
TrendMicro-HouseCall	TROJ_GEN.R002C0RLV20
Tencent	Win32.Trojan-banker.Rtm.Ebrh
Fortinet	W32/Kryptik.HIDC!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.ea4

How to remove Trojan-Banker.Win32.RTM.htz?

Trojan-Banker.Win32.RTM.htz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Banker.Win32.RTM.htz information