What is “Trojan.Win32.Agent.xahbyr”?

The Trojan.Win32.Agent.xahbyr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Agent.xahbyr virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan.Win32.Agent.xahbyr?


File Info:
crc32: C2EE774C
md5: d21b2f5794cb74d41410458cb09192fb
name: D21B2F5794CB74D41410458CB09192FB.mlw
sha1: f8634c2438ce9e013a560ee0931dfe3d50c4b9d0
sha256: 38788ae0c737818a59ce984cb1a7aff8907a1bd0f479609286d3bc6edca7e35c
sha512: 64b8e201947e1460e352f64d1dde7c3ece6c07e8107be0b65871f0ffb799f45ce98a87c300b5cdf2c8c445cc6047186acff314ebdb05cb3c5e669cd7ac9845dc
ssdeep: 6144:99X0GgVMiK1lZJ9nCPI0MEeLaPy2W1D8peRZDl6MWILomJnnkbkdgY0SpiwKOC:D0prK5CPIVdG6h9ZDHWILomJnkb13
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright indignant
FileVersion: 58.51.38.76
CompanyName: Fort-de-France
LegalTrademarks: Tayabas Ayta
Comments: be many
ProductName: normal value
FileDescription: East Timor
Translation: 0x0409 0x04e4

Trojan.Win32.Agent.xahbyr also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	BackDoor.SpyBotNET.25
FireEye	Generic.mg.d21b2f5794cb74d4
Qihoo-360	Win32/Trojan.Generic.HyoDnEIA
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005788e31 )
Alibaba	Trojan:Win32/SpyNoon.28f0b631
K7GW	Trojan ( 005788e31 )
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/Injector.AFC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	Trojan.Win32.Agent.xahbyr
AegisLab	Trojan.Win32.Agent.4!c
Rising	Trojan.Injector!8.C4 (CLOUD)
Comodo	Malware@#1efzil2xzgkw3
F-Secure	Trojan.TR/Injector.ewgax
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.MALREP.THCOBBA
McAfee-GW-Edition	BehavesLike.Win32.AdwareAdload.gc
Sophos	Mal/Generic-S
Ikarus	Trojan.Agent
Webroot	W32.Trojan.Gen
Avira	TR/Injector.ewgax
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/SpyNoon.SS!MTB
ZoneAlarm	HEUR:Trojan-PSW.Win32.Agensla.gen
Cynet	Malicious (score: 100)
AhnLab-V3	Dropper/Win32.NSIS.C4357071
McAfee	RDN/Generic.cf
Malwarebytes	Trojan.Dropper.NSIS
ESET-NOD32	a variant of Win32/Injector.EOSH
TrendMicro-HouseCall	Trojan.Win32.MALREP.THCOBBA
Tencent	Win32.Trojan.Agent.Wnlz
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Injector.AFC!tr
AVG	Win32:MalwareX-gen [Trj]

How to remove Trojan.Win32.Agent.xahbyr?

Trojan.Win32.Agent.xahbyr removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X