Trojan:Win32/Gozi.ARJ!MTB removal

The Trojan:Win32/Gozi.ARJ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Gozi.ARJ!MTB virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Collects information to fingerprint the system
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Gozi.ARJ!MTB?


File Info:
crc32: 8CB3A8A1
md5: 61c5b521ec479f3a56b2e0ae17dc7dae
name: 3dtap.exe
sha1: f6b5364aee4f00d65ae85de28b6ed43e5acba394
sha256: 89b0d560210534b575e35145143d13049cd70e02ed5a1bfbae9b251b52c9034f
sha512: 8b7d70338b63280e89af326ef580ddd2095457f57ac2c1a630fe737bd2db659ec727cde7499aa20d3001071b4e118a9fd830469223d0253c86443689dd786422
ssdeep: 6144:HRUKClejH/OpOR9UgnrJUuCy6vPBwzqkVzdZ19zNVgmpUt:HCp0jH/Op7RZzBwVt19zNa4Ut
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2005-2012 Oleg N. Scherbakov
InternalName: 7ZSfxMod
FileVersion: 1.6.0.2712
CompanyName: Oleg N. Scherbakov
PrivateBuild: December 30, 2012
ProductName: 7-Zip SFX
ProductVersion: 1.6.0.2712
FileDescription: 7z Setup SFX (x86)
OriginalFilename: 7ZSfxMod_x86.exe
Translation: 0x0000 0x04b0

Trojan:Win32/Gozi.ARJ!MTB also known as:

Bkav	W32.DownloadExtatsF.Trojan
MicroWorld-eScan	Dropped:Trojan.GenericKDZ.67418
FireEye	Dropped:Trojan.GenericKDZ.67418
CAT-QuickHeal	Trojan.Multi
McAfee	Artemis!61C5B521EC47
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 005676e91 )
BitDefender	Dropped:Trojan.GenericKDZ.67418
K7GW	Trojan ( 005676e91 )
CrowdStrike	win/malicious_confidence_80% (W)
TrendMicro	TROJ_GEN.R002C0DEQ20
BitDefenderTheta	Gen:NN.ZexaF.34122.ryW@au!HyxjG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HDPQ
APEX	Malicious
Avast	Win32:CoinminerX-gen [Trj]
GData	Dropped:Trojan.GenericKDZ.67418
Kaspersky	Trojan.Win32.Agent.xadvet
Alibaba	Trojan:Win32/Kryptik.9ad80881
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Win32.Trojan.Agent.Wopx
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Crypt.Agent.picnv
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
Emsisoft	Dropped:Trojan.GenericKDZ.67418 (B)
Ikarus	Trojan.Win32.Crypt
Avira	TR/Crypt.Agent.uvenm
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Gozi
Microsoft	Trojan:Win32/Gozi.ARJ!MTB
Arcabit	Trojan.Generic.D1075A
AhnLab-V3	Dropper/Win32.Agent.C4109666
ZoneAlarm	Trojan.Win32.Agent.xadvet
VBA32	BScope.Trojan.Download
ALYac	Dropped:Trojan.GenericKDZ.67418
Ad-Aware	Dropped:Trojan.GenericKDZ.67418
Malwarebytes	Trojan.Dropper.SFX
TrendMicro-HouseCall	TROJ_GEN.R002C0DEQ20
Rising	Trojan.Kryptik!1.C698 (CLASSIC)
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Kryptik.HPDO!tr
Webroot	W32.Trojan.Gen
AVG	Win32:CoinminerX-gen [Trj]
Cybereason	malicious.aee4f0
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.aaf

How to remove Trojan:Win32/Gozi.ARJ!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Gozi.ARJ!MTB removal