Trojan:Win32/Qakbot.GN!MTB removal guide

The Trojan:Win32/Qakbot.GN!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Qakbot.GN!MTB virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Installs itself for autorun at Windows startup
Creates a hidden or system file
Network activity detected but not expressed in API logs
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Qakbot.GN!MTB?


File Info:
crc32: D95C4274
md5: 25bb7618c80b2f912790e7f54f898a5f
name: 25BB7618C80B2F912790E7F54F898A5F.mlw
sha1: 96ffd62a194f6436592dd9a3c59fe9223bb72611
sha256: f57aff01f0d6a36bddeb8e7bbf8b33874c47a58d7827399c823424866aee33dd
sha512: d63fb34e6f6dd0d4ecde2bccf9ddb67c1516d4f4c82bce6f8479b0bfed6fafca7bd4b5f02b71859387f30ca432fc0c262df5e5739e6ba44b40f45b1e85c0e312
ssdeep: 3072:hKfqAxp7Trv/hQjtXCIiXZ4PAfTP8JsE0wtUFfDW:hKfbfTbpOCVXC4fTsfy1W
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1999-2010 Gladiators Software
InternalName: A2Master
FileVersion: 2, 0, 4, 0
CompanyName: Gladiators Software
Comments: http://www.aston2.com/
ProductName: Aston2
ProductVersion: 2, 0, 4, 0
FileDescription: A2Master Application
OriginalFilename: A2Master.exe
Translation: 0x0000 0x04b0

Trojan:Win32/Qakbot.GN!MTB also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35436580
CAT-QuickHeal	Trojan.Yakes
Qihoo-360	Generic/HEUR/QVM07.1.6681.Malware.Gen
ALYac	Trojan.GenericKD.35436580
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
BitDefender	Trojan.GenericKD.35436580
Cyren	W32/Trojan.ZKCL-3001
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.LN
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Yakes.gen
Alibaba	Trojan:Win32/Qakbot.5a5a5d8f
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.35436580
Emsisoft	Trojan.GenericKD.35436580 (B)
F-Secure	Trojan.TR/Redcap.avvqh
TrendMicro	TROJ_GEN.R002C0WKN20
McAfee-GW-Edition	Packed-GCY!25BB7618C80B
FireEye	Generic.mg.25bb7618c80b2f91
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Crypt
GData	Trojan.GenericKD.35436580
Jiangmin	Trojan.Zenpak.efx
Avira	TR/Redcap.avvqh
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.dd!n
Arcabit	Trojan.Generic.D21CB824
AegisLab	Hacktool.Win32.Krap.lKMc
ZoneAlarm	HEUR:Trojan.Win32.Yakes.gen
Microsoft	Trojan:Win32/Qakbot.GN!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4230845
McAfee	Packed-GCY!25BB7618C80B
MAX	malware (ai score=81)
VBA32	Trojan.Wacatac
Malwarebytes	Backdoor.Qbot
TrendMicro-HouseCall	TROJ_GEN.R002C0WKN20
SentinelOne	Static AI – Malicious PE
eGambit	PE.Heur.InvalidSig
Fortinet	W32/Kryptik.GLWT!tr
BitDefenderTheta	Gen:NN.ZexaF.34658.7q1@aiywYad
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Trojan:Win32/Qakbot.GN!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Qakbot.GN!MTB removal guide