Trojan:Win32/DefenseEvasion!rfn removal

The Trojan:Win32/DefenseEvasion!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/DefenseEvasion!rfn virus can do?

Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

redirector.gvt1.com

r5—sn-4g5ednsd.gvt1.com

How to determine Trojan:Win32/DefenseEvasion!rfn?


File Info:
crc32: BA1A4E35
md5: 43a4fc6882e77af10af81b0d4b539309
name: rundll32.exe
sha1: 5a51901ed046c1d891db9798a50c7c1c7e4794fe
sha256: a1943e1049daed30fa89a0e73b4c130c00935e2aecb171141ecd2d05cf783f9e
sha512: 0567ae983675a0bbcacf2823f22ead444353c148bb73ad07544eecdb19665dcf41eab9ac0fa32897cce61a238d219ae8871eef222e365cbdda9a2d12547e9a35
ssdeep: 384:BamXASQKt3AVI7JBQxLl/2ee6bHeJhCWc5RHW:xXAU6I7nQxZ/2ee6bS8R
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: rundll
FileVersion: 10.0.14393.0 (rs1_release.160715-1616)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.14393.0
FileDescription: Windows host process (Rundll32)
OriginalFilename: RUNDLL32.EXE
Translation: 0x0804 0x04b0

Trojan:Win32/DefenseEvasion!rfn also known as:

MicroWorld-eScan	Trojan.GenericKD.32745869
CAT-QuickHeal	Trojan.Multi
McAfee	RDN/Generic.glz
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.32745869
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_60% (W)
TrendMicro	TROJ_GEN.R002C0PJK19
Symantec	Trojan.Gen.MBT
GData	Trojan.GenericKD.32745869
Kaspersky	Trojan.Win32.Starter.anvz
Rising	Trojan.Generic@ML.83 (RDMK:vlq8u4rKjLN4foaDGTC2Dg)
Ad-Aware	Trojan.GenericKD.32745869
Sophos	Mal/Generic-S
Comodo	MalCrypt.Indus!@1qrzi1
F-Secure	Trojan.TR/Crypt.XPACK.Gen
Zillya	Trojan.Starter.Win32.38635
McAfee-GW-Edition	RDN/Generic.glz
FireEye	Trojan.GenericKD.32745869
Emsisoft	Trojan.GenericKD.32745869 (B)
Ikarus	Trojan.Crypt
Cyren	W32/Trojan.AEAO-5357
Avira	TR/Crypt.XPACK.Gen
Arcabit	Trojan.Generic.D1F3A98D
ZoneAlarm	Trojan.Win32.Starter.anvz
Microsoft	Trojan:Win32/DefenseEvasion!rfn
VBA32	BScope.Trojan.Tiggre
ALYac	Trojan.GenericKD.32745869
MAX	malware (ai score=99)
Malwarebytes	Trojan.FakeMS
Panda	Trj/Agent.YS
ESET-NOD32	a variant of Generik.NJXSIP
TrendMicro-HouseCall	TROJ_GEN.R002C0PJK19
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
Qihoo-360	HEUR/QVM20.1.8ECF.Malware.Gen

How to remove Trojan:Win32/DefenseEvasion!rfn?

Trojan:Win32/DefenseEvasion!rfn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/DefenseEvasion!rfn removal