Trojan:Win32/Rozena.ALR!MTB removal tips

The Trojan:Win32/Rozena.ALR!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Rozena.ALR!MTB virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
A process attempted to delay the analysis task.
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Rozena.ALR!MTB?


File Info:
crc32: 6C9675D2
md5: 5005c855504088eefe4007d33be56612
name: 5005C855504088EEFE4007D33BE56612.mlw
sha1: 464533a42e9bf127c694f57fae5173c443c2622b
sha256: 3fa6f08ae996b0374c5cbe1200f3e68eb4dacba25319becd76c0b5490ea83c68
sha512: 3cb848023685d9c3d75e5c63a20f24ded244198ddb30b0f2239c028987dfb6f35681ebbcb08ba422a02982beea164ef67008610e1dcae25b31348b422a057363
ssdeep: 12288:ahK81TkbpqOPoay5nxsVsSC5TDc98CufFB8o9Q/ykSg:T81r5nOsHVDc08L7P
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan:Win32/Rozena.ALR!MTB also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (W)
Alibaba	Trojan:Win32/Rozena.84e003b0
Cybereason	malicious.ef240d
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Rozena.AMU
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.Inject.gen
Sophos	ATK/Phantom-B
BitDefenderTheta	Gen:NN.ZexaF.34790.bGX@aOACIEd
TrendMicro	TROJ_GEN.R005C0DG321
McAfee-GW-Edition	BehavesLike.Win32.Generic.lm
FireEye	Generic.mg.18c3cfc76f6f9586
SentinelOne	Static AI – Suspicious PE
Microsoft	Trojan:Win32/Rozena.ALR!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
AhnLab-V3	Malware/Win.Generic.R373288
McAfee	Artemis!18C3CFC76F6F
VBA32	BScope.Trojan.Phave
TrendMicro-HouseCall	TROJ_GEN.R005C0DG321
Ikarus	Trojan.Win32.Meterpreter
Fortinet	W32/Phave.ABG!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml

How to remove Trojan:Win32/Rozena.ALR!MTB?

Trojan:Win32/Rozena.ALR!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Rozena.ALR!MTB removal tips