Trojan:Win32/Spynoon.RFB!MTB removal

The Trojan:Win32/Spynoon.RFB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Spynoon.RFB!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Dynamic (imported) function loading detected
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Attempts to bypass application whitelisting by executing .NET utility in a suspended state, potentially for injection
• CAPE detected the RedLine malware family

How to determine Trojan:Win32/Spynoon.RFB!MTB?

File Info:
name: 1BA08448DA95DECCF432.mlw
path: /opt/CAPEv2/storage/binaries/6eb51a0793261bfcf67a046afd507210ec54419887c1ddca244acdf469bd433f
crc32: EE8FD709
md5: 1ba08448da95deccf432c8796ce5d274
sha1: 7ec94e4569549495323873b99983abe12a11dc3d
sha256: 6eb51a0793261bfcf67a046afd507210ec54419887c1ddca244acdf469bd433f
sha512: ae0485bd90f20960a91e0dcc13453ab69bf708aed1bcf5db18406b78bfbd7f17454d35443d038451e8e93d3f49c9014b14827afa92c13a78f84764fdeb8f796c
ssdeep: 24576:29If0xTzsyyasEzaPubqzdfyG+ItPgpLC6QSzchFW30cxWxYM3:df05zFyasEzaPubqz4IYikfWxL3
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T175057B43614CB2B1E9701170A4618AA30CCDBB394E8F3CDBF3581FF660D395965A9BB6
sha3_384: 667fb74d8e16eb2e34d27f4cca062a3548e6f3cac1a37368fb768433f9a5734b054c8eb954766d121ebfbd959a9bea6f
ep_bytes: e8b4050000e974feffff558bec6a00ff
timestamp: 2022-04-11 08:20:33

Version Info:
CompanyName: Epic Games, Inc.
LegalCopyright: Copyright Epic Games, Inc. All Rights Reserved.
ProductName: Easy Anti-Cheat Bootstrapper (EOS)
ProductVersion: 1.3.1
FileDescription: Easy Anti-Cheat Bootstrapper (EOS)
InternalName: Easy Anti-Cheat Bootstrapper (EOS)
Translation: 0x0409 0x04b0

Trojan:Win32/Spynoon.RFB!MTB also known as:

How to remove Trojan:Win32/Spynoon.RFB!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.