Should I remove “VHO:Net-Worm.Win32.Convagent”?

The VHO:Net-Worm.Win32.Convagent is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Net-Worm.Win32.Convagent virus can do?

At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Authenticode signature is invalid
Anomalous binary characteristics

How to determine VHO:Net-Worm.Win32.Convagent?


File Info:
name: 97BDA795938DDB97593F.mlw
path: /opt/CAPEv2/storage/binaries/23f476a1fd865d343a4ea1358882d923ed14d0257195202aef6f1e5a02f57bf4
crc32: AD062D35
md5: 97bda795938ddb97593f625c45d0b391
sha1: e85e52648a613a9ac2f524aa9911e83f7b9634d5
sha256: 23f476a1fd865d343a4ea1358882d923ed14d0257195202aef6f1e5a02f57bf4
sha512: 23e5150dc8f998abf830fe956ff9abc853a84ad8788033eaf3c9dcb52ee81f6b98d8d66457671a2271092b5891426a3ec264f0ab847f395936cdcdac311db99b
ssdeep: 6144:3hqGHMUxwPtZPFvNtCbEV1cxNmkBVF8bNiT0KyrWdUJT/4DO/B52pRr3zmiTVVmk:3hjMlPtZJnguczzBV00sJj4DO/B52n
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T149C47E037BE440BBE8234632C5B0979496B7FAE46D618F8B12943D2C7E749C1DD26B39
sha3_384: 6767e0bcd9bda2cf6f57df97daae430fb01edfaba2402511da8eb60a3629c187fc7fb750609270bef67a94325c10ca01
ep_bytes: 02344300e869e4020051568bf16a10e8
timestamp: 2015-12-03 04:44:46

Version Info:
0: [No Data]

VHO:Net-Worm.Win32.Convagent also known as:

Bkav	W32.AIDetect.malware1
Lionic	Worm.Win32.Convagent.p!c
MicroWorld-eScan	Trojan.GenericKD.38117945
FireEye	Trojan.GenericKD.38117945
ALYac	Trojan.GenericKD.38117945
K7AntiVirus	Trojan ( 0058aa851 )
BitDefender	Trojan.GenericKD.38117945
K7GW	Trojan ( 0058aa851 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FNRY
Baidu	Win32.Worm.Agent.u
Kaspersky	VHO:Net-Worm.Win32.Convagent.gen
Alibaba	Trojan:Win32/GenKryptik.fd1cdf54
Ad-Aware	Trojan.GenericKD.38117945
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R011C0PKO21
McAfee-GW-Edition	RDN/Generic.hra
Emsisoft	Trojan.GenericKD.38117945 (B)
Ikarus	Trojan.Win32.Krypt
Avira	TR/Kryptik.cdlfq
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Ransom.Win32.Sabsik.sa
GData	Trojan.GenericKD.38117945
Cynet	Malicious (score: 99)
McAfee	RDN/Generic.hra
TrendMicro-HouseCall	TROJ_GEN.R011C0PKO21
Yandex	Trojan.GenKryptik!ITXVnvTHu0Q
Fortinet	W32/GenKryptik.FNRY!tr
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen

How to remove VHO:Net-Worm.Win32.Convagent?

VHO:Net-Worm.Win32.Convagent removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X