Win32:Patched-RR [Trj] removal instruction

The Win32:Patched-RR [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Patched-RR [Trj] virus can do?

Executable code extraction
Injection with CreateRemoteThread in a remote process
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Mimics the system’s user agent string for its own requests
At least one IP Address, Domain, or File Name was found in a crypto call
Starts servers listening on 0.0.0.0:34601, :0
Expresses interest in specific running processes
Reads data out of its own binary image
Drops a binary and executes it
Performs some HTTP requests
Code injection with CreateRemoteThread in a remote process
Tries to unhook or modify Windows functions monitored by Cuckoo
Steals private information from local Internet browsers
A system process is generating network traffic likely as a result of process injection
Installs itself for autorun at Windows startup
Creates Zeus (Banking Trojan) mutexes
Zeus P2P (Banking Trojan)
Attempts to modify proxy settings
Attempts to modify browser security settings
Harvests credentials from local FTP client softwares
Creates a slightly modified copy of itself
Collects information to fingerprint the system
Clears web history

Related domains:

z.whorecord.xyz

a.tomx.xyz

kosnwnrpnumrm.com

ocsp.pki.goog

kwqoutmkxpjvupsm.info

crls.pki.goog

crl.pki.goog

odzjhsuujnkzpu.com

fnuihjortspukir.biz

How to determine Win32:Patched-RR [Trj]?


File Info:
crc32: 5D017E8E
md5: 93eb83774f21ac712f7766d458601761
name: 93EB83774F21AC712F7766D458601761.mlw
sha1: 6fcd7da5c7ef5817fe5038265b87dafba82574f7
sha256: 050458750f20063832b0c1b62e83e4def62d1e29b5399ac871683438e5c5c584
sha512: 761b02b750318a2fd25f99ad628800884b00f0f5896fc2a385d80744ce1a87e28da2ac15794ff80b3da1b1bfe544ade3b97214eb941902c29318273d89e0e897
ssdeep: 3072:mxgSUFFBIRt/ExeDtnDbeWynTrJFqLX5EMCXuqS4go5M0wzi4inCN9uzDM8:mxgvFFmqeDtnne1nTroX5EMCLSVWrwGr
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Win32:Patched-RR [Trj] also known as:

Bkav	W32.Licat.PE
K7AntiVirus	Virus ( 0040fa811 )
Lionic	Virus.Win32.Murofet.li7L
Elastic	malicious (high confidence)
DrWeb	BackDoor.Zbot.30
Cynet	Malicious (score: 100)
CAT-QuickHeal	W32.Murofet.A
ALYac	Win32.Murofet.A
Cylance	Unsafe
Zillya	Virus.Murofet.Win32.1
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Virus:Win32/Murofet.0fc809ba
K7GW	Virus ( 0040fa811 )
Cybereason	malicious.74f21a
Baidu	Win32.Virus.Murofet.a
Cyren	W32/Murofet.A
Symantec	Trojan.Zbot.B!inf
ESET-NOD32	Win32/TrojanDownloader.Small.PAC
APEX	Malicious
Avast	Win32:Patched-RR [Trj]
ClamAV	Win.Trojan.Murofet-1
Kaspersky	Virus.Win32.Murofet.a
BitDefender	Win32.Murofet.A
NANO-Antivirus	Virus.Win32.Nimnul.bhskb
ViRobot	Win32.Murofet.A
MicroWorld-eScan	Win32.Murofet.A
Tencent	Virus.Win32.Licat.a
Ad-Aware	Win32.Murofet.A
Sophos	ML/PE-A + W32/Murofet-A
Comodo	Virus.Win32.Murofet.a@245onq
BitDefenderTheta	AI:FileInfector.A399AEAE0F
VIPRE	Virus.Win32.Murofet.a (v)
TrendMicro	PE_LICAT.A
McAfee-GW-Edition	BehavesLike.Win32.ZBot.ch
FireEye	Generic.mg.93eb83774f21ac71
Emsisoft	Win32.Murofet.A (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanSpy.Zbot.anuk
Webroot	W32.Malware.Gen
Avira	W32/Murofet.A
eGambit	Unsafe.AI_Score_93%
Antiy-AVL	Trojan/Generic.ASVirus.69
Kingsoft	Win32.Infected.AutoInfector.a.(kcloud)
Microsoft	Virus:Win32/Zbot.B
Arcabit	Win32.Murofet.A
ZoneAlarm	Virus.Win32.Murofet.a
GData	Win32.Murofet.A
AhnLab-V3	Win32/Murofet
McAfee	W32/Zbot.a
MAX	malware (ai score=100)
VBA32	Virus.Win32.Murofet.A
Panda	Generic Malware
TrendMicro-HouseCall	PE_LICAT.A
Rising	Virus.Licat!1.9ABB (CLASSIC)
Yandex	Trojan.GenAsa!x6hVQHmW+Dc
Ikarus	Virus.Win32.Murofet
MaxSecure	Virus.W32.Murofet.A
Fortinet	W32/Murofet.A
AVG	Win32:Patched-RR [Trj]
Paloalto	generic.ml

How to remove Win32:Patched-RR [Trj]?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32:Patched-RR [Trj] removal instruction