Trojan.Win64 removal guide

The Trojan.Win64 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win64 virus can do?

Executable code extraction
At least one process apparently crashed during execution
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to repeatedly call a single API many times in order to delay analysis time
Checks the system manufacturer, likely for anti-virtualization
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

dssp.workday360.cn

pubg.heymoney.cn

How to determine Trojan.Win64?


File Info:
crc32: 85B12285
md5: 7dbb40c212338528e38d17e6d13303e8
name: jsqxm.exe
sha1: 3b631a5f88e2adbdfabdbb37a2e27617801553f9
sha256: 7e6a8cccff91befc771994412d6d78a8d426c99cd900fd2a54f5efc3058ba2ea
sha512: 7fdad3b4835caa5475a7c52114d915a23907e759bf1608d6ac7d10141550566f49016fd746b5eaf14bcc29652841abea347809bad2c9f2ad9e55747ed65b8a88
ssdeep: 49152:rYkIC4om4eVxXWUqeXruBNaFA2ZbG/IMSWPDAWIle08LxNZUM2Zh+7u:r2C4jDXWgX6N8A2ZbGQMjPDQleVVNZU
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
0: [No Data]

Trojan.Win64 also known as:

MicroWorld-eScan	Generic.Exploit.Shellcode.2.94B20EDB
CAT-QuickHeal	Trojan.Win64
McAfee	Artemis!7DBB40C21233
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (W)
BitDefender	Generic.Exploit.Shellcode.2.94B20EDB
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Arcabit	Generic.Exploit.Shellcode.2.94B20EDB
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Generik.ZTOCSY
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win64.Shelma.bzb
Alibaba	Trojan:Application/Generic.1572d51f
ViRobot	Trojan.Win32.Z.Shelma.2395136
Tencent	Win32.Trojan.Downloader.Altb
Ad-Aware	Generic.Exploit.Shellcode.2.94B20EDB
Emsisoft	Generic.Exploit.Shellcode.2.94B20EDB (B)
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.DownLoader26.64702
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.vc
Fortinet	W32/Shelma.AF34!tr
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.7dbb40c212338528
Sophos	Mal/Generic-S
SentinelOne	DFI – Malicious PE
Jiangmin	Trojan.Shelma.cpn
Avira	TR/Downloader.Gen
MAX	malware (ai score=89)
Endgame	malicious (moderate confidence)
Microsoft	Trojan:Win32/Occamy.C
ZoneAlarm	Trojan.Win64.Shelma.bzb
AhnLab-V3	Malware/Win32.Generic.C3365953
VBA32	BScope.Trojan.Tonmye
ALYac	Generic.Exploit.Shellcode.2.94B20EDB
Panda	Trj/CI.A
Rising	Trojan.Generic@ML.96 (RDMK:QcUON9b9k71J9KvqU4KmLA)
Ikarus	Trojan-Downloader
eGambit	Unsafe.AI_Score_93%
GData	Generic.Exploit.Shellcode.2.94B20EDB
AVG	Win32:Malware-gen
Cybereason	malicious.212338
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.2c0

How to remove Trojan.Win64?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Win64 removal guide