About "Trojan:Win32/Remhead" infection

The Trojan:Win32/Remhead is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Remhead virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Unconventionial language used in binary resources: Chinese (Traditional)
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Detects Sandboxie through the presence of a library
Deletes its original binary from disk
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Remhead?


File Info:
crc32: 0AF5142B
md5: 420b270bc6d2460155b1b5fff8b22f4d
name: 420B270BC6D2460155B1B5FFF8B22F4D.mlw
sha1: ebba49e56bc5776a8dcd9f3b4688007d3c0a9fa7
sha256: 15cd331abc1d7a7201f156be2163ae9acf9d7d78bbff540ccd5f01addffb3197
sha512: 113a2ed085a228d092cb298a09887c90bbb41ccaba60ed23b68586aadf6c4137d97ac83070f03c64ffd93b3d8ca2a83bc5ca25132e2174e007b73c7ba48c6880
ssdeep: 24576:syT46bMLV3GYFln34BqXsEWBpxA8TOJ4gXjANEAzn5pFdljzeyUYd/aTkBQTZvE:saAhGYznLSBf3OJD8n5pvMg/aTkBQTZ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright:                                               
: 
InternalName:         
Description:                                     
        : r%x01FileDescription
           :                            
LegalTrademarks: 
Comments: 
                :             
                        : r%x01FileDescription
FileVersion:        
Translation: 0x0409 0x04b0

Trojan:Win32/Remhead also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.Dn0@dHlDF@pj
FireEye	Generic.mg.420b270bc6d24601
McAfee	Artemis!420B270BC6D2
Cylance	Unsafe
VIPRE	VirTool.Win32.VBInject.gen.dp (v)
AegisLab	Trojan.Win32.VB.l4bq
Sangfor	Malware
K7AntiVirus	NetWorm ( 700000151 )
BitDefender	Gen:Trojan.Heur.Dn0@dHlDF@pj
K7GW	NetWorm ( 700000151 )
CrowdStrike	win/malicious_confidence_100% (D)
Cyren	W32/VBInject.AN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMetagen [Malware]
ClamAV	Win.Trojan.Agent-733652
Kaspersky	Trojan.Win32.Agent.aibxu
NANO-Antivirus	Trojan.Win32.Buzus.bkewri
Tencent	Win32.Trojan.Agent.Oyop
Ad-Aware	Gen:Trojan.Heur.Dn0@dHlDF@pj
Emsisoft	Gen:Trojan.Heur.Dn0@dHlDF@pj (B)
Comodo	TrojWare.Win32.VBInject.IK@1qsu2f
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Inject.22654
Zillya	Trojan.Buzus.Win32.56606
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	ML/PE-A + Mal/Nyrate-B
Ikarus	Net-Worm.Win32.Kolab
eGambit	Unsafe.AI_Score_99%
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.Buzus
Kingsoft	Win32.Troj.Buzus.(kcloud)
Microsoft	Trojan:Win32/Remhead
Arcabit	Trojan.Heur.E02E41
ZoneAlarm	Trojan.Win32.Agent.aibxu
GData	Gen:Trojan.Heur.Dn0@dHlDF@pj
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.VBNA.R3814
Acronis	suspicious
BitDefenderTheta	AI:Packer.D11274141C
ALYac	Gen:Trojan.Heur.Dn0@dHlDF@pj
MAX	malware (ai score=80)
VBA32	TScope.Trojan.VB
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Generic Malware
ESET-NOD32	a variant of Win32/Injector.AWK
Rising	Dropper.Generic!8.35E (CLOUD)
Yandex	Trojan.GenAsa!W3grhXhw9HQ
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Refroso.AGEA!tr
Webroot	Trojan:Win32/Remhead
AVG	FileRepMetagen [Malware]
Qihoo-360	HEUR/QVM03.0.Malware.Gen

How to remove Trojan:Win32/Remhead?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan:Win32/Remhead” infection