Trojan:Win32/DefenseEvasion!rfn removal

Malware Removal

The Trojan:Win32/DefenseEvasion!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan:Win32/DefenseEvasion!rfn virus can do?

  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

Related domains:

redirector.gvt1.com
r5—sn-4g5ednsd.gvt1.com

How to determine Trojan:Win32/DefenseEvasion!rfn?


File Info:

crc32: BA1A4E35
md5: 43a4fc6882e77af10af81b0d4b539309
name: rundll32.exe
sha1: 5a51901ed046c1d891db9798a50c7c1c7e4794fe
sha256: a1943e1049daed30fa89a0e73b4c130c00935e2aecb171141ecd2d05cf783f9e
sha512: 0567ae983675a0bbcacf2823f22ead444353c148bb73ad07544eecdb19665dcf41eab9ac0fa32897cce61a238d219ae8871eef222e365cbdda9a2d12547e9a35
ssdeep: 384:BamXASQKt3AVI7JBQxLl/2ee6bHeJhCWc5RHW:xXAU6I7nQxZ/2ee6bS8R
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: rundll
FileVersion: 10.0.14393.0 (rs1_release.160715-1616)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.14393.0
FileDescription: Windows host process (Rundll32)
OriginalFilename: RUNDLL32.EXE
Translation: 0x0804 0x04b0

Trojan:Win32/DefenseEvasion!rfn also known as:

MicroWorld-eScanTrojan.GenericKD.32745869
CAT-QuickHealTrojan.Multi
McAfeeRDN/Generic.glz
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Multi.Generic.4!c
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.32745869
K7GWRiskware ( 0040eff71 )
CrowdStrikewin/malicious_confidence_60% (W)
TrendMicroTROJ_GEN.R002C0PJK19
SymantecTrojan.Gen.MBT
GDataTrojan.GenericKD.32745869
KasperskyTrojan.Win32.Starter.anvz
RisingTrojan.Generic@ML.83 (RDMK:vlq8u4rKjLN4foaDGTC2Dg)
Ad-AwareTrojan.GenericKD.32745869
SophosMal/Generic-S
ComodoMalCrypt.Indus!@1qrzi1
F-SecureTrojan.TR/Crypt.XPACK.Gen
ZillyaTrojan.Starter.Win32.38635
McAfee-GW-EditionRDN/Generic.glz
FireEyeTrojan.GenericKD.32745869
EmsisoftTrojan.GenericKD.32745869 (B)
IkarusTrojan.Crypt
CyrenW32/Trojan.AEAO-5357
AviraTR/Crypt.XPACK.Gen
ArcabitTrojan.Generic.D1F3A98D
ZoneAlarmTrojan.Win32.Starter.anvz
MicrosoftTrojan:Win32/DefenseEvasion!rfn
VBA32BScope.Trojan.Tiggre
ALYacTrojan.GenericKD.32745869
MAXmalware (ai score=99)
MalwarebytesTrojan.FakeMS
PandaTrj/Agent.YS
ESET-NOD32a variant of Generik.NJXSIP
TrendMicro-HouseCallTROJ_GEN.R002C0PJK19
FortinetW32/PossibleThreat
AVGWin32:Malware-gen
AvastWin32:Malware-gen
Qihoo-360HEUR/QVM20.1.8ECF.Malware.Gen

How to remove Trojan:Win32/DefenseEvasion!rfn?

Trojan:Win32/DefenseEvasion!rfn removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment