Trojan.MSIL.Agent.adrxh (file analysis)

The Trojan.MSIL.Agent.adrxh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.MSIL.Agent.adrxh virus can do?

Presents an Authenticode digital signature
Creates RWX memory
The binary likely contains encrypted or compressed data.
Collects information to fingerprint the system

How to determine Trojan.MSIL.Agent.adrxh?


File Info:
crc32: AF8AC334
md5: 18513c3863e882c4f5d6ef25fa15782a
name: Protection_ID.eXe
sha1: 8837609df92b862589b1a638fd6eb5fbb0c009d2
sha256: 503a03322363cc3766c76eacc02c3ef70bb836b0ae98c3a90518e5933f3cd5fc
sha512: e5ccf28c2c177e1a499eb8b7316888844779750682348010919f6bcf77ba56a5bfb1a31e263748f22ca98321a72f78353cbdceb12f67459aa1a27b0416cd065d
ssdeep: 24576:c8tggHkHfTAduwL1RU3LBEzT+NAYGCDV5B/RXkUx1aXU0CAMX4LP:L7osduwL/UgT+NdGk//RUU1YIA8o
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 [PiD Team] 2002-2016
InternalName: [PiD Team] Protection ID v0.6.8.0
FileVersion: 0.6.8.0
CompanyName: [PiD Team] (CDKiller/TippeX)
PreReleaseBuild: Please do NOT release / distribute / leak this release to the pubic
ProductName: PiD Team's Protection ID v0.6.8.0
ProductVersion: 0.6.8.0
FileDescription: PiD Team's Protection ID
OriginalFilename: Protection_ID.eXe
Build: 0.6.8.0
Translation: 0x0409 0x04e4

Trojan.MSIL.Agent.adrxh also known as:

CAT-QuickHeal	Trojan.Creprote
McAfee	PUP-XFB-RS
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R002C0PFO18
Paloalto	generic.ml
Kaspersky	Trojan.MSIL.Agent.adrxh
Rising	Trojan.Agent!8.B1E (CLOUD)
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
McAfee-GW-Edition	PUP-XFB-RS
Fortinet	W32/Generic!tr
Sophos	Generic PUA II (PUA)
Webroot	W32.Gen.Bt
Avira	TR/Obfuscate.bogra
Endgame	malicious (high confidence)
Microsoft	PUA:Win32/Creprote
ZoneAlarm	Trojan.MSIL.Agent.adrxh
AhnLab-V3	PUP/Win32.Helper.C1689341
VBA32	Trojan.MSIL.Agent
Panda	Trj/GdSda.A
Yandex	PUA.Toolbar.SoftonicDown!
Ikarus	Trojan.Win32.Pepatch
Qihoo-360	Win32/Trojan.770

How to remove Trojan.MSIL.Agent.adrxh?

Trojan.MSIL.Agent.adrxh removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X