Trojan

What is “Trojan.Win32.DelShad.duw”?

Malware Removal

The Trojan.Win32.DelShad.duw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.DelShad.duw virus can do?

  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Attempts to delete volume shadow copies
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Network activity detected but not expressed in API logs
  • Creates a copy of itself
  • Attempts to interact with an Alternate Data Stream (ADS)
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Trojan.Win32.DelShad.duw?


File Info:

crc32: 99EC7465
md5: 33b80a574c6441baf5409a292aafb1cf
name: upload_file
sha1: 8048aba11ea6209d1f49fa4e12741050350557df
sha256: ab007094afec534a2aa64436f214866014a664e7399aeaf361790ede5eec6b56
sha512: 52843695c364814c0d0d375f68f9c7202a26e492f59c01eaf23dd366da443ae6a02c2a7ff1748a033658808e900a61e097deb95c98de3744f2767faa040ddc00
ssdeep: 1536:PAQM6+we8+cHM4RJPLhxLHQn5GssJEdkBofdlhviUNCo/TMwXK:PAQFZ+siJhJ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan.Win32.DelShad.duw also known as:

BkavW32.AIDetectVM.malware2
Elasticmalicious (high confidence)
ClamAVWin.Malware.Agent-9662653-0
CAT-QuickHealRansom.WSLocker.S15413983
McAfeeRansom-Wasted!33B80A574C64
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Win32.DelShad.4!c
K7AntiVirusTrojan ( 0056994f1 )
AlibabaTrojan:Win32/DelShad.2152b3a1
K7GWTrojan ( 0056994f1 )
Cybereasonmalicious.74c644
InvinceaMal/Generic-S
CyrenW32/WastedLocker.B.gen!Eldorado
SymantecRansom.WastedLocker!gm
ESET-NOD32a variant of Win32/Filecoder.WastedLocker.A
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyTrojan.Win32.DelShad.duw
BitDefenderGen:Variant.Razy.702165
NANO-AntivirusTrojan.Win32.DelShad.hpppoy
ViRobotTrojan.Win32.S.WastedLocker.59392
MicroWorld-eScanGen:Variant.Razy.702165
RisingRansom.GanWaste!8.11E8C (TFE:4:0KX5jFYhbNC)
Ad-AwareGen:Variant.Razy.702165
Comodo.UnclassifiedMalware@0
F-SecureTrojan.TR/AD.Ursnif.svtpe
DrWebTrojan.Encoder.32185
ZillyaTrojan.DelShad.Win32.608
TrendMicroRansom.Win32.WASTEDLOCKER.SMYAAF-A
MaxSecureTrojan.Malware.74134469.susgen
FireEyeGeneric.mg.33b80a574c6441ba
SophosMal/Generic-S
SentinelOneDFI – Suspicious PE
JiangminTrojan.DelShad.adj
AviraTR/AD.Ursnif.svtpe
Antiy-AVLTrojan/Win32.DelShad
MicrosoftRansom:Win32/GanWaste.A!MTB
ArcabitTrojan.Razy.DAB6D5
ZoneAlarmTrojan.Win32.DelShad.duw
GDataGen:Variant.Razy.702165
AhnLab-V3Trojan/Win32.Ransom.C4170354
VBA32Trojan.DelShad
ALYacTrojan.Ransom.WastedLocker
MAXmalware (ai score=100)
MalwarebytesRansom.BinADS
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom.Win32.WASTEDLOCKER.SMYAAF-A
TencentWin32.Trojan.Filecoder.Lkea
IkarusTrojan-Ransom.WastedLocker
eGambitUnsafe.AI_Score_98%
FortinetW32/Ursnif.CR!tr.ransom
BitDefenderThetaAI:Packer.60AB6F381E
AVGWin32:Trojan-gen
AvastWin32:Trojan-gen
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.6e4

How to remove Trojan.Win32.DelShad.duw?

Trojan.Win32.DelShad.duw removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment