Trojan:Win32/Tonmye!rfn removal tips

The Trojan:Win32/Tonmye!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Tonmye!rfn virus can do?

Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Tonmye!rfn?


File Info:
crc32: F24625A4
md5: c14dd1f53a0b081c0f5756f5343d4ae7
name: gqkd.exe
sha1: 0b845e07b9d38023181a826b80afc35ccac8b29c
sha256: da20fbced63a2dbaad70e2b8fa08ab801f7434f450e8862ef08c4e19fb79e821
sha512: 015a031aceba0a8ad8195768e7d63ed19734cc6929db9bc4fb084c05eadb5732be1465d98ce97bda46621d81a3b29fe803a6802b725f62f7eb6987f792e1e53f
ssdeep: 98304:PFro4mk29b0FZDV6r5m0ab4d/MBWwgP+IBpWVL:lfl2uF65mzb4d/qgPBpWV
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: x56fax4e54x5de5x4f5cx5ba4
FileVersion: 9.0.0.0
CompanyName: x56fax4e54x5de5x4f5cx5ba4
Comments: x6570x767ex5bb6x5febx9012x6279x91cfx67e5x8be2x5de5x5177
ProductName: x56fax4e54x5febx9012x67e5x8be2x52a9x624b
ProductVersion: 9.0.0.0
FileDescription: x5febx9012x516cx53f8x81eax52a8x8bc6x522bx3001x5febx9012x5355x53f7x6279x91cfx67e5x8be2x8f6fx4ef6
Translation: 0x0804 0x04b0

Trojan:Win32/Tonmye!rfn also known as:

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.GenericKD.32757930
FireEye	Generic.mg.c14dd1f53a0b081c
McAfee	Artemis!C14DD1F53A0B
ALYac	Trojan.GenericKD.32757930
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.4!c
K7AntiVirus	Adware ( 005070c51 )
BitDefender	Trojan.GenericKD.32757930
K7GW	Adware ( 005070c51 )
Cybereason	malicious.53a0b0
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34090.ppKfaGBjs6ib
F-Prot	W32/Trojan.CLL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.BlackMoon.A potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R002C0DKS19
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.32757930
Alibaba	Trojan:Win32/Tonmye.153611dc
Endgame	malicious (moderate confidence)
Sophos	Generic PUA AL (PUA)
Comodo	Malware@#2g1h0bnqg0fjt
F-Secure	Trojan.TR/Tonmye.faqrr
TrendMicro	TROJ_GEN.R002C0DKS19
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
SentinelOne	DFI – Malicious PE
Emsisoft	Trojan.GenericKD.32757930 (B)
APEX	Malicious
Cyren	W32/Trojan.CLL.gen!Eldorado
Avira	TR/Tonmye.faqrr
Antiy-AVL	GrayWare/Win32.FlyStudio.a
Arcabit	Trojan.Generic.D1F3D8AA
Microsoft	Trojan:Win32/Tonmye.gen!rfn
Acronis	suspicious
VBA32	BScope.Trojan.Tiggre
MAX	malware (ai score=85)
Ad-Aware	Trojan.GenericKD.32757930
Malwarebytes	Trojan.Agent
Panda	Trj/GdSda.A
Rising	Trojan.Kryptik!1.B3E8 (CLOUD)
Ikarus	PUA.BlackMoon
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/QQWare.A!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
MaxSecure	Trojan.Malware.74719127.susgen

How to remove Trojan:Win32/Tonmye!rfn?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Tonmye!rfn removal tips