VHO:Backdoor.Win32.Ruskill removal guide

The VHO:Backdoor.Win32.Ruskill is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Backdoor.Win32.Ruskill virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine VHO:Backdoor.Win32.Ruskill?


File Info:
crc32: 8036F354
md5: 0d459a9762572513cf3d1a4c84707fa3
name: 0D459A9762572513CF3D1A4C84707FA3.mlw
sha1: 69c4e8deea6be9d7509fa6b72ae2bd484de42fd8
sha256: b87622ead26347ccef7029bdde1ea0393196dc571f649f2e0c24020eefbb7ec4
sha512: 76ff06828994476fb5a7ce98a2b1490199a1d49c67aa10952ad9ba02df6a4bcc4a153aae49699d940d797e228be0b15799eda27ce0e2c63a200cf1c01210bd5f
ssdeep: 24576:Fs+/xcbpjcW8TEV3Dm18Hp/dg+yWxZtjWmP3Lcwr/KkB++3rMd1kAaJuNchhg8u:Fs+/xc1YHTEdgq6+j7tjWS/SkB++3rM
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1998-2020 VMware, Inc.
InternalName: vmnetcfg
FileVersion: 16.1.0 build-17198959
CompanyName: 
ProductName: 
ProductVersion: 16.1.0 build-17198959
FileDescription: 
OriginalFilename: vmnetcfglib.dll
Translation: 0x0409 0x04b0

VHO:Backdoor.Win32.Ruskill also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (D)
Cybereason	malicious.eea6be
Cyren	W32/Noon.V.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.EnigmaProtector.J suspicious
Zoner	Probably Heur.ExeHeaderH
APEX	Malicious
ClamAV	Win.Packed.Fileinfector-9829236-0
Kaspersky	VHO:Backdoor.Win32.Ruskill.gen
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34738.ED0@a4hvHcbi
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
FireEye	Generic.mg.0d459a9762572513
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1142957
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASBOL.C669
Microsoft	Trojan:MSIL/SpyNoon.RTU!MTB
AhnLab-V3	Trojan/Win.SpyNoon.R415181
Acronis	suspicious
VBA32	Trojan.Zpevdo
Panda	Trj/Genetic.gen
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazpWTdwLVQcterti6hMzVNIV)
Ikarus	PUA.EnigmaProtector
MaxSecure	Trojan.Malware.300983.susgen

How to remove VHO:Backdoor.Win32.Ruskill?

VHO:Backdoor.Win32.Ruskill removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X