Categories: Adware

Dropped:Adware.Agent.TPQ information

The Dropped:Adware.Agent.TPQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Dropped:Adware.Agent.TPQ virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Anomalous file deletion behavior detected (10+)
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Created a process from a suspicious location

How to determine Dropped:Adware.Agent.TPQ?


File Info:

name: 41306E8B3B01E911B9DE.mlwpath: /opt/CAPEv2/storage/binaries/d9b9614f6800d2f3f1303870fa925c0c002c6b7c483aa857bde1bdbfa5f208d8crc32: DCEDD0DAmd5: 41306e8b3b01e911b9def8e65d84e9c2sha1: d6b9a7dd05f1c170dae06973108fca51080bedf6sha256: d9b9614f6800d2f3f1303870fa925c0c002c6b7c483aa857bde1bdbfa5f208d8sha512: 469401dc70e8eb7c2ce45f598917f91631b65a20d471a0171a2b6db65f1163c32a50ac583a3b66d1ed834120b0286cc199d0e7bab1d4c50857da31d5b6c48645ssdeep: 24576:xNSICzE+YIBfImPw2FEHlyUbTxYW+RUdXrHV9eAl47elI0X/KkJd8:x4ILImmo2FCFbTxo0bHze77IPXd8type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B5453335A0988B8AC41BF434C19784E7A76EE91666B1A6AD2D144CE63C031FFDB0735Fsha3_384: c0b4823d1a316c8fb167d4933c4661fd8e9690e9c951eaacb22581c168281136bfe44d989c26e92c1318ab2932c0fc2cep_bytes: 558bec81ec2c0500005356576a015e6atimestamp: 2000-04-25 14:37:12

Version Info:

CompanyName: FileDescription: NetAnts 1.25 InstallationFileVersion: LegalCopyright:

Dropped:Adware.Agent.TPQ also known as:

FireEye Dropped:Adware.Agent.TPQ
ALYac Dropped:Adware.Agent.TPQ
Alibaba AdWare:Win32/Cydoor.18be4986
Cybereason malicious.b3b01e
VirIT Adware.Win32.Cydoor.B
Elastic malicious (high confidence)
Zoner Probably Heur.ExeHeaderP
ClamAV Win.Adware.Cydoor-1
BitDefender Dropped:Adware.Agent.TPQ
NANO-Antivirus Riskware.Win32.Cydoor.dbuuzk
Avast Win32:PUP-gen [PUP]
Rising Trojan.Bitrep!8.F596 (CLOUD)
Emsisoft Dropped:Adware.Agent.TPQ (B)
McAfee-GW-Edition Adware-CyDoor
Ikarus AdWare.Cydoor
Jiangmin Trojan.Generic.dlxct
Webroot W32.Malware.Gen
MAX malware (ai score=94)
Kingsoft Win32.Adware.Cydoor.(kcloud)
Microsoft Trojan:Win32/Occamy.CD9
GData Dropped:Adware.Agent.TPQ
VBA32 AdWare.Cydoor
Malwarebytes Malware.AI.2420356519
Yandex Adware.Cydoor!AkzFFVl15Do
MaxSecure Trojan.Malware.1571.susgen
Fortinet Riskware/Cydoor
AVG Win32:PUP-gen [PUP]
CrowdStrike win/grayware_confidence_60% (D)

How to remove Dropped:Adware.Agent.TPQ?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

Backdoor:Win32/Y3KRatpro.0_2 removal

The Backdoor:Win32/Y3KRatpro.0_2 is considered dangerous by lots of security experts. When this infection is active,…

47 seconds ago

Win32/Injector_AGen.ABF removal

The Win32/Injector_AGen.ABF is considered dangerous by lots of security experts. When this infection is active,…

6 mins ago

Trojan.ZbotRI.S28718216 information

The Trojan.ZbotRI.S28718216 is considered dangerous by lots of security experts. When this infection is active,…

6 mins ago

Trojan:Win32/CryptInject!pz removal guide

The Trojan:Win32/CryptInject!pz is considered dangerous by lots of security experts. When this infection is active,…

6 mins ago

How to remove “W32/Autorun-BFG”?

The W32/Autorun-BFG is considered dangerous by lots of security experts. When this infection is active,…

12 mins ago

Generic.Dacic.94CCEEA9.A.BE5626CA removal instruction

The Generic.Dacic.94CCEEA9.A.BE5626CA is considered dangerous by lots of security experts. When this infection is active,…

12 mins ago