Trojan.Win32.Phave.d removal instruction

The Trojan.Win32.Phave.d is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Phave.d virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan.Win32.Phave.d?


File Info:
name: 13EF26641ECB475BD4D8.mlw
path: /opt/CAPEv2/storage/binaries/a1e16ce6c65edc88740305220910cb45b256b2f52112bc9ac8714971c552a9b7
crc32: 12D17E27
md5: 13ef26641ecb475bd4d8c060d7433273
sha1: a73babe8d8e9a377623fd52cceb1f19d5a1adab8
sha256: a1e16ce6c65edc88740305220910cb45b256b2f52112bc9ac8714971c552a9b7
sha512: 7d9822599ed9368379287a3f2cc19cb8229308b2dec13e80b947dadf817e6730c663540945c7cd19f50d0d9275e531319abe5d110f24485daba1a34341118c3a
ssdeep: 6144:mujmx2z1N92AuFsfQorq/rcmt4lLhU+VNu7j73Viyc:mujNxN9GFsfygmt4lLhPVN07gv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15FA4C84E5A9FEA61C1204270B643D984AC807376A92DDC77B3D8EF5FA831C9E5F09706
sha3_384: 83aff8a97b3b5674472304b0c0500c7107d52cdb9da1fe3a961467223d5bdd2dfa683bc47bd3e7d3e726a391d7f71ecb
ep_bytes: c7056cf0460001000000e9b1fcffff90
timestamp: 2022-10-12 10:08:55

Version Info:
0: [No Data]

Trojan.Win32.Phave.d also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fragtor.54547
FireEye	Generic.mg.13ef26641ecb475b
McAfee	RDN/Generic.dx
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Fragtor.54547
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Fragtor.DD513
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Rozena.AMC
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Phave.d
Rising	Trojan.Generic@AI.96 (RDMK:cmRtazrGYKww/90V5nJk0kSHh9R7)
Ad-Aware	Gen:Variant.Fragtor.54547
Sophos	Mal/Generic-S + ATK/Phantom-B
VIPRE	Gen:Variant.Fragtor.54547
McAfee-GW-Edition	RDN/Generic.dx
Emsisoft	Gen:Variant.Fragtor.54547 (B)
Ikarus	Trojan.Win32.Rozena
Avira	TR/Downloader.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Fragtor.54547
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R529220
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34754.BKX@aWOFNsh
ALYac	Gen:Variant.Fragtor.54547
MAX	malware (ai score=84)
VBA32	BScope.Trojan.Phave
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/PossibleThreat
AVG	Win32:Trojan-gen
Cybereason	malicious.8d8e9a
Avast	Win32:Trojan-gen

How to remove Trojan.Win32.Phave.d?

Trojan.Win32.Phave.d removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X