Backdoor.Win32.Agent.dfil removal

The Backdoor.Win32.Agent.dfil is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.Win32.Agent.dfil virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Reads data out of its own binary image
Authenticode signature is invalid

How to determine Backdoor.Win32.Agent.dfil?


File Info:
name: 2B6480B53C31E0170482.mlw
path: /opt/CAPEv2/storage/binaries/07f2a31bd7be49d96509ef261e5d8f4300b9b3a7dd75bc908756237b8a9d76fe
crc32: 215EDA3A
md5: 2b6480b53c31e0170482ebf9cd3b90a5
sha1: 5d6a6314700c44b4089e954179668a94333938a1
sha256: 07f2a31bd7be49d96509ef261e5d8f4300b9b3a7dd75bc908756237b8a9d76fe
sha512: e2ab221472531ed19752401be77e0c6ee3bffee96135dd3350cc51e29b52900b4411df45d18a174bb94d715a41abf12002e6a44ce5f46db63806f36addf02d44
ssdeep: 196608:cWq0SRBdnj/qTgdCuoUKqGcpIb8k2+MWzUAg+XfZ1gm7hK2MNGCmED8Wjmk6IY:rQR/ekAPUyc1kBXfPnBhVhnQ87f
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D5C6330D55F1F57CE902053132F9C7726BA9E9261B0AE82FB016F10BEE91079DA5722F
sha3_384: bf4ba0b07dd040779cc0eb11d60fb0962db83d73dad1bad4357f05ec8b5ed3220efb1fee80b1c6221bb221e5a1970639
ep_bytes: 558bec6aff68d017420068a4d7410064
timestamp: 2004-12-17 08:58:40

Version Info:
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 2, 0, 0, 24
InternalName: 
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
PrivateBuild: 
ProductName: Hammer Heads Deluxe Installatie Programma 
ProductVersion: 2, 0, 0, 24
SpecialBuild: 
Translation: 0x0409 0x04b0

Backdoor.Win32.Agent.dfil also known as:

MicroWorld-eScan	Trojan.GenericKD.47444120
FireEye	Trojan.GenericKD.47444120
ALYac	Trojan.GenericKD.47444120
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Backdoor:Win32/Spyware.d4146d8e
K7GW	Riskware ( 0040eff71 )
Cyren	W32/Backdoor.TGFU-7161
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/HackTool.Crack.KZ potentially unsafe
Kaspersky	Backdoor.Win32.Agent.dfil
BitDefender	Trojan.GenericKD.47444120
NANO-Antivirus	Trojan.Win32.Agent.cjsbfd
Avast	Win32:Spyware-gen [Spy]
Tencent	Malware.Win32.Gencirc.114cf404
Ad-Aware	Trojan.GenericKD.47444120
Emsisoft	Trojan.GenericKD.47444120 (B)
Comodo	Malware@#1fwfynmk1hr9r
DrWeb	Trojan.KeySpy.69
McAfee-GW-Edition	BehavesLike.Win32.Dropper.wc
Sophos	Mal/Generic-R
GData	Trojan.GenericKD.47444120
Avira	ADSPY/Agent.12534371
Antiy-AVL	Trojan/Generic.ASMalwS.74FB51
Kingsoft	Win32.Hack.Agent.ax.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
McAfee	Artemis!2B6480B53C31
MAX	malware (ai score=98)
VBA32	Backdoor.Agent
TrendMicro-HouseCall	TROJ_GEN.R002H0CKI21
Rising	Backdoor.Agent!8.C5D (CLOUD)
Yandex	Trojan.Agent!EW48SEDa/IQ
AVG	Win32:Spyware-gen [Spy]

How to remove Backdoor.Win32.Agent.dfil?

Backdoor.Win32.Agent.dfil removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X