Win32/BackSwap.A removal tips

The Win32/BackSwap.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/BackSwap.A virus can do?

Executable code extraction
Creates RWX memory
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/BackSwap.A?


File Info:
crc32: 2EB8B223
md5: 71ee00bda0853a1125abff75d5301f34
name: 71EE00BDA0853A1125ABFF75D5301F34.mlw
sha1: 13babb5eab26ec1efc7f86766d9c0544f9a3f3c6
sha256: 4ef16794237c0cc7328bcfbcd750bc3a238186b24fe101eb019c00e853c6445a
sha512: 9470c77bc668430861166d30122095cf46e8943448af6610930e6eed19221a689b357a1756ec2c52c726e5412d4d3e8933c5d43e7775678a49eb7caf147829dd
ssdeep: 6144:XGkZDugsYW02QnZlmR75Yi2X3IQCn3fjA9VZFzUxXOdy/KkicWM+5nXwB:XGCuf026ZlmR70Y/k9VS+LPMR
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (c) 1999-2016 Igor Pavlov
InternalName: 7zFM
FileVersion: 16.02
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 16.02
FileDescription: 7-Zip File Manager
OriginalFilename: 7zFM.exe
Translation: 0x0409 0x04b0

Win32/BackSwap.A also known as:

MicroWorld-eScan	Trojan.GenericKD.40468637
FireEye	Trojan.GenericKD.40468637
McAfee	Artemis!71EE00BDA085
Cylance	Unsafe
AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Trojan.Win32.GenericKD.4
K7AntiVirus	Trojan ( 00523e7e1 )
BitDefender	Trojan.GenericKD.40468637
K7GW	Trojan ( 00523e7e1 )
Cybereason	malicious.da0853
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Trojan-Banker.Win32.ClipBanker.msc
Alibaba	Trojan:Win32/Bulta.24c8c74a
Ad-Aware	Trojan.GenericKD.40468637
Emsisoft	Trojan.GenericKD.40468637 (B)
Comodo	Malware@#3kl53rhw7g6xd
McAfee-GW-Edition	BehavesLike.Win32.BadFile.gh
Sophos	ATK/Shellter-H
Ikarus	Trojan.Win32.Clipbanker
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Win32/Bulta!rfn
Arcabit	Trojan.Generic.D269809D
ZoneAlarm	Trojan-Banker.Win32.ClipBanker.msc
GData	Trojan.GenericKD.40468637
ALYac	Trojan.GenericKD.40468637
ESET-NOD32	Win32/BackSwap.A
Rising	Trojan.ClipBanker!8.5FB (CLOUD)
Yandex	Trojan.Cossta!xMBzI9YqC0Q
AVG	FileRepMalware

How to remove Win32/BackSwap.A?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/BackSwap.A removal tips