Trojan:Win32/Remcos.RS!MTB removal

The Trojan:Win32/Remcos.RS!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Remcos.RS!MTB virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Remcos.RS!MTB?


File Info:
crc32: 7685CA81
md5: d441c317c91b2d02fd7118d9395391de
name: upload_file
sha1: 81802cdc26cd23f07c87369bceeef346fc6764d5
sha256: 4b183077cbfa209aab597f0cfe66178add15a0d590ba3abdf170ae708617bfef
sha512: f07b53080edc6194067fbf5ffe9d4f8ed41609677c795ef1d3ecd04e1904b31d722d331ba037f29b5b79c1655aa41730474157c3050da496ffb3df98a831887b
ssdeep: 12288:kB/Z3LDx5poUjzEKGsMDTOVeryD+X1pSlRk1/jYGloIZLIyADyJCC5jdmp65dy3N:EImI8hXXhb/op3detKEIddHl8N
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1998-2017 Mark Russinovich 
InternalName: Process Explorer
FileVersion: 16.21
CompanyName: Sysinternals - www.sysinternals.com
LegalTrademarks: Copyright (C) 1998-2017 Mark Russinovich 
ProductName: Process Explorer
ProductVersion: 16.21
FileDescription: Sysinternals Process Explorer
OriginalFilename: Procexp.exe
Translation: 0x0409 0x04e4

Trojan:Win32/Remcos.RS!MTB also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34762247
CAT-QuickHeal	Backdoor.Remcos
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Virus ( 7000000f1 )
BitDefender	Trojan.GenericKD.34762247
K7GW	Virus ( 7000000f1 )
TrendMicro	Backdoor.Win32.REMCOS.THJOGBO
Cyren	W32/Bulz.C.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Dropper.LokiBot-9775229-0
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
Alibaba	TrojanDownloader:Win32/Remcos.7e6ebdf5
NANO-Antivirus	Trojan.Win32.Remcos.hyshix
ViRobot	Trojan.Win32.Z.Wacatac.984024
Tencent	Malware.Win32.Gencirc.11b009bf
Ad-Aware	Trojan.GenericKD.34762247
Emsisoft	Trojan.GenericKD.34762247 (B)
Comodo	Malware@#zkcq5kwbko58
F-Secure	Trojan.TR/Crypt.XPACK.luujb
DrWeb	Trojan.PWS.Stealer.29406
Invincea	Mal/Generic-S
McAfee-GW-Edition	RDN/Generic Downloader.x
FireEye	Generic.mg.d441c317c91b2d02
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Jiangmin	Backdoor.Remcos.cfk
Avira	TR/Crypt.XPACK.luujb
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Backdoor]/Win32.Remcos
Microsoft	Trojan:Win32/Remcos.RS!MTB
Arcabit	Trojan.Generic.D2126E07
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.34762247
Cynet	Malicious (score: 100)
AhnLab-V3	Downloader/Win32.Agent.R349910
BitDefenderTheta	Gen:NN.ZelphiF.34566.8G2@aOCY43pi
ALYac	Trojan.GenericKD.43990697
VBA32	BScope.Trojan.Downloader
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/Agent.PM
Zoner	Trojan.Win32.95452
ESET-NOD32	Win32/TrojanDownloader.Delf.DAX
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.THJOGBO
Rising	Trojan.Kryptik!1.C56D (KTSE)
Yandex	Trojan.Igent.bUz6hn.18
Fortinet	Malicious_Behavior.SB
Webroot	W32.Trojan.Gen
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	Win32/Backdoor.a07

How to remove Trojan:Win32/Remcos.RS!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Remcos.RS!MTB removal