Trojan.Win32.Agent.xahamp removal

The Trojan.Win32.Agent.xahamp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Agent.xahamp virus can do?

Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan.Win32.Agent.xahamp?


File Info:
crc32: 842C15D8
md5: db02b0b9211fcaf7a6c0b4fbbf675958
name: DB02B0B9211FCAF7A6C0B4FBBF675958.mlw
sha1: 1ce7fcf4cc07c1d0fbcbb245edc4b1b68face2e3
sha256: 0e1ec8c0b16042cc5f4e0c137f3939aa3e4a47096b32f1c2d41baf1a0d9aa177
sha512: ecb4d66ce7ff4a2f0b43b8672337dcfb886d86aa4eb42191eb284242fab472accf626f6488c305fe93b30189f8195b8719539e2ab5e67c78c26e902bc242a2f7
ssdeep: 6144:59X0GJETZtl9TKd8ef5SCTc7XC68yHP/mc8:/0oOWSefQCaSgP/O
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: Copyright Northern Huishui Hmong Written Latin Script
FileVersion: 49.41.77.39
CompanyName: possessive adjective
LegalTrademarks: Hokkaido
Comments: academic department
ProductName: protein engineering
FileDescription: East Timor
Translation: 0x0409 0x04e4

Trojan.Win32.Agent.xahamp also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36398465
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Agent.4!c
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005786211 )
BitDefender	Trojan.GenericKD.36398465
K7GW	Trojan ( 005786211 )
Cybereason	malicious.4cc07c
Cyren	W32/Trojan.XGIB-5895
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:InjectorX-gen [Trj]
Kaspersky	Trojan.Win32.Agent.xahamp
Alibaba	TrojanSpy:Win32/Formbook.0e0ca38e
Rising	Trojan.Injector!8.C4 (CLOUD)
Ad-Aware	Trojan.GenericKD.36398465
Sophos	Mal/Generic-S + Troj/Formbo-UL
Comodo	Malware@#ndko5bib7mth
F-Secure	Trojan.TR/Injector.laeij
DrWeb	Trojan.Siggen12.9677
TrendMicro	TROJ_FRS.VSNW1AB21
McAfee-GW-Edition	BehavesLike.Win32.Vopak.dc
FireEye	Generic.mg.db02b0b9211fcaf7
Emsisoft	Trojan.GenericKD.36398465 (B)
Ikarus	Trojan.Inject
Avira	TR/Injector.laeij
MAX	malware (ai score=99)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Predator!ml
Gridinsoft	Trojan.Win32.Downloader.sa
Arcabit	Trojan.Generic.D22B6581
ZoneAlarm	HEUR:Trojan-Spy.Win32.Noon.gen
GData	Trojan.GenericKD.36398465
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Androm.R367639
McAfee	Artemis!DB02B0B9211F
Malwarebytes	Generic.Malware/Suspicious
ESET-NOD32	Win32/Formbook.AA
SentinelOne	Static AI – Suspicious PE
Fortinet	Malicious_Behavior.SB
BitDefenderTheta	Gen:NN.ZexaE.34590.aqW@aq79UImi
AVG	Win32:InjectorX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/TrojanSpy.Noon.HoMASPsA

How to remove Trojan.Win32.Agent.xahamp?

Trojan.Win32.Agent.xahamp removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X