Categories: Malware

Application.DealAgent.AROV removal tips

The Application.DealAgent.AROV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Application.DealAgent.AROV virus can do?

Behavioural detection: Executable code extraction – unpacking
Scheduled file move on reboot detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Application.DealAgent.AROV?


File Info:
name: DF699C2C1C35A8234AAE.mlwpath: /opt/CAPEv2/storage/binaries/ae745757e185bdacc06b39cf6d77ca956b2e2d72008b230e848fd2547fffd919crc32: A51DD585md5: df699c2c1c35a8234aae0a82a01422cesha1: cdf436f0a3756cc21fe6b441c2dc5e5a99f24d37sha256: ae745757e185bdacc06b39cf6d77ca956b2e2d72008b230e848fd2547fffd919sha512: abbd11cbd6cd7ca5729723ed8283e8d41ce1b79b6ae540f17e5be040fbfaf7054f38c98e90ace85c2e482803ee8eedb4af094526603af9c31d5bdd84bcab56b6ssdeep: 24576:CHigYOAewnZDoCpj0j0ESYESTGN1DdSdZEjWx1eWn1k2MBTlP0QjcpMXVJo8:CCOPwZ0CpAj+y63D4ZECPeek2GpfTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D6653317D9371979E063CC758D3AC448516EFD582E38E00AB185AB9F3B36AE194363B3sha3_384: ddbd642bafb99ce929e8e25117e90b5ae4d01d373fc48a6ed3ace65f98249d9f8c82a379a1a5f99f9eee9d080486c2e4ep_bytes: 558bec83c4c453565733c08945f08945timestamp: 1992-06-19 22:22:17
Version Info:
Comments: This installation was built with Inno Setup.CompanyName: AdworldInternetFileDescription: installer setupFileVersion: 1.0.1.1LegalCopyright: AdworldInternetProductName: installer setupProductVersion: 1.0.1.1Translation: 0x0000 0x04b0

Application.DealAgent.AROV also known as:

Bkav	W32.AIDetect.malware2
Lionic	Adware.Win32.DealPly.2!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Application.DealAgent.AROV
FireEye	Generic.mg.df699c2c1c35a823
ALYac	Application.DealAgent.AROV
Cylance	Unsafe
Zillya	Tool.DealAgent.Win32.4600
Sangfor	Adware.Win32.InstallCore.1
Alibaba	AdWare:Win32/InstallCore.d298db3a
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	Trojan.Gen.2
ESET-NOD32	Win32/InstallCore.Gen.A potentially unwanted
Kaspersky	not-a-virus:AdWare.Win32.DealPly.cvijf
BitDefender	Application.DealAgent.AROV
NANO-Antivirus	Virus.InnoSetup.Gen.ccng
SUPERAntiSpyware	PUP.InstallCore/Variant
Avast	Win32:Dropper-gen [Drp]
Rising	Adware.InstallCore!1.A30C (CLASSIC)
Ad-Aware	Application.DealAgent.AROV
Sophos	InnoMod (PUA)
Comodo	ApplicUnwnt@#28z8wjs96q4i6
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.tc
SentinelOne	Static AI – Suspicious PE
Emsisoft	Application.InstallDeal (A)
APEX	Malicious
GData	Win32.Application.InstallCore.KW
Microsoft	Trojan:Win32/Wacatac.A!ml
Cynet	Malicious (score: 100)
AhnLab-V3	PUP/Win32.Installer.R202591
McAfee	Artemis!DF699C2C1C35
MAX	malware (ai score=96)
VBA32	Malware-Cryptor.2LA.gen
Malwarebytes	Adware.InstallCore
Yandex	PUA.DealPly!kezxNucfOZw
Fortinet	Riskware/DealPly
Webroot	Adware.Installcore
AVG	Win32:Dropper-gen [Drp]
Cybereason	malicious.c1c35a
Panda	Trj/CI.A