Should I remove “VHO:Backdoor.MSIL.Zlugin”?

The VHO:Backdoor.MSIL.Zlugin is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Backdoor.MSIL.Zlugin virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine VHO:Backdoor.MSIL.Zlugin?


File Info:
name: 685B81D8284641DD547A.mlw
path: /opt/CAPEv2/storage/binaries/f2f89616ff87bed1ee2f8121299aeae0d9dfbcc021658373e7d0189df7393720
crc32: C6B61EF8
md5: 685b81d8284641dd547adeae02e1ee2a
sha1: aca496298747ad1b489f579183c4ae757e9fa008
sha256: f2f89616ff87bed1ee2f8121299aeae0d9dfbcc021658373e7d0189df7393720
sha512: 705c2e1bd63812e3b3cdd2dde77587d529ea174d1eea06c1581eccbd38ea5b14a043956f3812990235ca31f79e50c8bc837888d873f82a3a4c2c0c6e5f0019e8
ssdeep: 24576:GqyId05G0gn7i0wHOyLPjZVUOByIcoosWASayVlmRb8GhgFB:G8d7ihxeoKC18GhgFB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T158755B4C239B8815ED408BF1D9B667832753D3B9C842534793A9BE3CD62B3BE0B50796
sha3_384: ba5012ea0ba9e9dd0eed80f12b76ebf0bd4c1d081b35e50d2ddcb9626a1a9099bc77d1046aca1122982e676f6d88d3fa
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-04-23 05:30:28

Version Info:
Translation: 0x0000 0x04b0
Comments: Viotto Ocx Registrator
CompanyName: BreakingSecurity.net
FileDescription: Viotto Ocx Registrator
FileVersion: 1.1.0.0
InternalName: Krubpp.exe
LegalCopyright: BreakingSecurity.net
LegalTrademarks: 
OriginalFilename: Krubpp.exe
ProductName: Viotto Ocx Registrator
ProductVersion: 1.1.0.0
Assembly Version: 1.1.0.0

VHO:Backdoor.MSIL.Zlugin also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
McAfee	AgentTesla-FDIG!685B81D82846
Cylance	Unsafe
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Trojan.EmbeddedDotNetBinary-9940868-0
Kaspersky	VHO:Backdoor.MSIL.Zlugin.gen
F-Secure	Heuristic.HEUR/AGEN.1202164
DrWeb	Trojan.DownloaderNET.366
McAfee-GW-Edition	AgentTesla-FDIG!685B81D82846
FireEye	Generic.mg.685b81d8284641dd
Ikarus	Trojan.Inject
Avira	HEUR/AGEN.1202164
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Rising	Trojan.Generic/MSIL@AI.92 (RDM.MSIL:py9W1e4rZxkrOPdbd0fYwQ)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34606.Hn0@aStuy2i
CrowdStrike	win/malicious_confidence_60% (D)

How to remove VHO:Backdoor.MSIL.Zlugin?

VHO:Backdoor.MSIL.Zlugin removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X