Trojan.Agent.DRPH removal tips

The Trojan.Agent.DRPH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.DRPH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup

How to determine Trojan.Agent.DRPH?

File Info:
name: DAB646A3C39A06192286.mlw
path: /opt/CAPEv2/storage/binaries/605bf95a3c082b523c7c22f2e8b420df5be510313f54377604c3b0829027443b
crc32: D8BA8D6C
md5: dab646a3c39a06192286ef24af0323ef
sha1: 032fd0795e440075bbec5428daa9ea470bb1750b
sha256: 605bf95a3c082b523c7c22f2e8b420df5be510313f54377604c3b0829027443b
sha512: cf4bd1ca3ce7eed4c461cfe1544e9c87a9b1aa2f3ece077679e9aac6983623a08a5927f39268a913487525cdb36c17c69d4db5d02aae0e21f660673077b49726
ssdeep: 6144:v6X6T00NoZ+12gCXBExWbeTKMab3HJJObPIm5N7uI/pGlV60:SKxaE12gCXBExWb8DabXJJb4puX360
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CF44225C981FF1D2D1F67A77A65A81C05080F8265E96B1A99C63B3A389F30E0FA54733
sha3_384: 5c46d4989a20a878b4f8c1516dd7cbf81061aafe8cc95d70215225394dad0212cfda9ef3364ba837d214dfb05604ac9a
ep_bytes: 60be007042008dbe00a0fdff57eb0b90
timestamp: 2016-03-26 04:49:14

Version Info:
0: [No Data]

Trojan.Agent.DRPH also known as:

How to remove Trojan.Agent.DRPH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.