What is “VHO:Trojan-Proxy.Win32.Convagent”?

The VHO:Trojan-Proxy.Win32.Convagent is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Trojan-Proxy.Win32.Convagent virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine VHO:Trojan-Proxy.Win32.Convagent?


File Info:
name: 8C36E56E019C3BD5E03C.mlw
path: /opt/CAPEv2/storage/binaries/61715a77b98fc8532d6fb72c9cc3dba269ef866b12b68b40921202b4016589c4
crc32: 763FB60C
md5: 8c36e56e019c3bd5e03cbfb7c448a0fb
sha1: 3f94423a028c0f361934064119edbf34e16f0834
sha256: 61715a77b98fc8532d6fb72c9cc3dba269ef866b12b68b40921202b4016589c4
sha512: 737f6c69debbe2cbf2c2ae0ef0e0dd0e3965d8975e77bb6704f01caaedf27f0a08bdcc29da119feb5f614aab8de1206c1251177f58a045351c644cd3d07d47d1
ssdeep: 1536:UQRaCu6a3k8dP9EVQdG6ewQMPppjaqxFEja2VV6VExcvyn+A:UnD6a08dP9EOdLebMPjbM2VEJ3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T165A459404A60A882E1233638B57DE244376A7C6F5B668E6DCB417EB00B717079C32E7F
sha3_384: c58dc3241226e33737eb52ab139baa10e7bccd1ef405fa78df0ed984df3e8e7b2b45b85872b98c15d22f81b3fe118b7d
ep_bytes: 00000000000000000000000000000000
timestamp: 2020-07-11 03:39:59

Version Info:
0: [No Data]

VHO:Trojan-Proxy.Win32.Convagent also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Sdum.4!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.gz
Malwarebytes	Backdoor.Padodor
Sangfor	Trojan.Win32.Agent.V12a
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Renos-10003935-0
Kaspersky	VHO:Trojan-Proxy.Win32.Convagent.gen
Rising	Trojan.Generic@AI.100 (RDML:igUR1t+gdX4gFCQEs6vvng)
Sophos	ML/PE-A
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.8c36e56e019c3bd5
Ikarus	Trojan.Crypt
Varist	W32/Kryptik.JOR.gen!Eldorado
Kingsoft	malware.kb.a.1000
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	VHO:Trojan-Proxy.Win32.Convagent.gen
Google	Detected
McAfee	Artemis!8C36E56E019C
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R03BH0CK823
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Qukart.8979!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.a028c0
Avast	Win32:Evo-gen [Trj]

How to remove VHO:Trojan-Proxy.Win32.Convagent?

VHO:Trojan-Proxy.Win32.Convagent removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X