Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

Diplugem.JS.A removal instruction

Published Feb 21, 2024 Malware category 3 min read
Report context

What to verify before removal

This report keeps Diplugem.JS.A removal instruction in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

Start by comparing the local file name with 9CC589F4D740F316BECA.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
9CC589F4D740F316BECA.mlw
  • Compare the suspicious file name with 9CC589F4D740F316BECA.mlw.
  • Confirm the detection name matches Diplugem.JS.A removal instruction before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The Diplugem.JS.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Diplugem.JS.A virus can do?

  • A file was accessed within the Public folder.
  • Sample contains Overlay data
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to create or modify a Browser Helper Object
  • Anomalous binary characteristics
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Diplugem.JS.A?



File Info:

name: 9CC589F4D740F316BECA.mlw
path: /opt/CAPEv2/storage/binaries/e5343966e730c5e2ca477307f6fbba8ac495e09bf3bd5ed7620a212c73497aae
crc32: F634A52F
md5: 9cc589f4d740f316beca47ff101518ca
sha1: 87b3424e788a6f84fe635c1ba676df60ac1ff298
sha256: e5343966e730c5e2ca477307f6fbba8ac495e09bf3bd5ed7620a212c73497aae
sha512: fc678ce885e625657674e30e890029263e78ac4dfd6492ea664d1f6b6b7c76bdbce4cbec89b4d02c4311648562998413b947cf62a3005ee702dc1b3ddbfd148b
ssdeep: 6144:h1OgDPdkBAFZWjadD4s5LlWejtjW2W+YVfa8rlw7dqC:h1OgLdaOLY3dfVfgqC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16C44D02139E1C8FAD6521431CEA42FD2E2F9E6240F31887737984A1D6F7D585C13BB5A
sha3_384: 172f7af37a393eff3471e83c055b98f482f9ca22a0b5a242776bde3bac1b578af09035c9f22ac18cd19087274a3eb612
ep_bytes: 558bec6aff68e0b94100682c4a410064
timestamp: 2010-11-18 16:27:35


Version Info:

CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX
FileVersion: 9.20
InternalName: 7zS.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFilename: 7zS.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.20
Translation: 0x0409 0x04b0

Diplugem.JS.A also known as:

Bkav W32.AIDetectMalware
MicroWorld-eScan Dropped:Adware.JS.MultiPlug.A
ClamAV Legacy.Trojan.Trojan-1039
FireEye Dropped:Adware.JS.MultiPlug.A
CAT-QuickHeal Diplugem.JS.A
Skyhigh BehavesLike.Win32.Downloader.dc
McAfee Downloader-FLN
Cylance unsafe
VIPRE Dropped:Adware.JS.MultiPlug.A
Sangfor Suspicious.Win32.Save.ins
CrowdStrike win/grayware_confidence_100% (D)
Alibaba AdWare:Script/MegaSearch.06c55b23
VirIT Adware.Win32.Plugin.P
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 multiple detections
APEX Malicious
Cynet Malicious (score: 100)
BitDefender Dropped:Adware.JS.MultiPlug.A
NANO-Antivirus Riskware.Script.Plugin.cjvvyt
Avast JS:Browsermodifier-B [Trj]
Tencent Win32.Script.Agent.Rsmw
Emsisoft Dropped:Adware.JS.MultiPlug.A (B)
F-Secure Adware.ADWARE/Multiplug.ZJ
TrendMicro ADW_MULTIPLUG
Trapmine malicious.high.ml.score
Sophos Generic ML PUA (PUA)
Jiangmin AdWare.Script.q
Webroot W32.Adware.Multplug
Avira ADWARE/Adware.Gen7
MAX malware (ai score=99)
Antiy-AVL Trojan/Win32.SGeneric
Kingsoft Win32.Troj.MegaSearch.am
Xcitium Application.Win32.Multiplug.D@4rev5n
Arcabit Adware.JS.MultiPlug.A
ZoneAlarm not-a-virus:HEUR:AdWare.Script.Generic
GData Win32.Trojan.Multiplug.E
Varist JS/MPlug.A
ALYac Dropped:Adware.JS.MultiPlug.A
Malwarebytes Generic.Malware.AI.DDS
TrendMicro-HouseCall ADW_MULTIPLUG
Rising Adware.ScrInject!1.CF70 (CLASSIC)
Ikarus PUA.Monetizer.Gen7
MaxSecure Adware.JS.MultiPlug.P
Fortinet Adware/MultiPlug
AVG JS:Browsermodifier-B [Trj]
DeepInstinct MALICIOUS

How to remove Diplugem.JS.A?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.