What is “VHO:Backdoor.MSIL.Androm”?

The VHO:Backdoor.MSIL.Androm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Backdoor.MSIL.Androm virus can do?

Network activity detected but not expressed in API logs

How to determine VHO:Backdoor.MSIL.Androm?


File Info:
crc32: 4DE00BCC
md5: c8dda172a1b70d273679c40e8a0b0e89
name: C8DDA172A1B70D273679C40E8A0B0E89.mlw
sha1: 1bcb05fb57bee5a92d4ba567ff1fea3e866ac281
sha256: 520457786da0e88af9df6022e8e87642d0cc6c3b1aaf34082b929a0b3aed6074
sha512: f5bfea07e1f2b183459e1001be9137902b01c48d2d091c992a3a6b5d58a3f9eb594a227ff217ae5ade8812895c9e0662f0b2269af09ba5a6fa2ad2cec3c05038
ssdeep: 12288:BiOJenoLLoS60/K7yh0ioLtx/1TyT+N4q9GoLHhuieXA:Bz4noLAikr/1TyTNqLHtf
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2018
Assembly Version: 1.0.0.0
InternalName: 1OWGx635g4nx592ax631.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: SortingVisualizer
ProductVersion: 1.0.0.0
FileDescription: SortingVisualizer
OriginalFilename: 1OWGx635g4nx592ax631.exe

VHO:Backdoor.MSIL.Androm also known as:

Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
Cyren	W32/MSIL_Kryptik.DLB.gen!Eldorado
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/GenKryptik.FEMX
APEX	Malicious
Kaspersky	VHO:Backdoor.MSIL.Androm.gen
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.bh
FireEye	Generic.mg.c8dda172a1b70d27
McAfee	Artemis!C8DDA172A1B7
Malwarebytes	Malware.AI.643625791

How to remove VHO:Backdoor.MSIL.Androm?

VHO:Backdoor.MSIL.Androm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X