VHO:Trojan.Win32.Diple removal tips

The VHO:Trojan.Win32.Diple is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VHO:Trojan.Win32.Diple virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Created a process from a suspicious location
• Creates a copy of itself

How to determine VHO:Trojan.Win32.Diple?

File Info:
name: 3E9F0C25281E956ACCB4.mlw
path: /opt/CAPEv2/storage/binaries/ff067712a1ae9fdb72435289def752fe9279780e3888fb993c4466a822f07351
crc32: 90D50850
md5: 3e9f0c25281e956accb4cad9055c5ac6
sha1: 4491daaeeaddaee1046478975ed8e698a43d331a
sha256: ff067712a1ae9fdb72435289def752fe9279780e3888fb993c4466a822f07351
sha512: 8ced5c1566448edebe1f0c909801e44da568ace0081105b542ea62981122e1499082eb5c0ef29fa136336af08a273500ca0389ec12770b8c68ef05c8c859f126
ssdeep: 6144:KRj/O5vbF/GSJuZTFlt56unuxULuzNz6evNOjLcWhkwycHs9RYjqk/usmSQgzxgN:KdqFluZ3KuM20zvUmJIjXJUWO+EzQRN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T135D423773344E014F0E1C5728507FD9E051EEE2BA5A43CEE3B641C2DA8B3B4B516AE86
sha3_384: 186bdd31f8749e924eaea225672236a12485bceb9fd8513780a7df7c1b8138d391cdbe7a1f40fc5b694ef1dc959dc3fa
ep_bytes: 60be00d04c008dbe0040f3ff57eb0b90
timestamp: 2007-01-30 01:50:00

Version Info:
CompanyName: Qper1 Software
FileDescription: Qper1 Internet Browser
FileVersion: 1190
InternalName: Qper1
LegalCopyright: Copyright © Qper1 Software 1995-2011
OriginalFilename: Qper1.exe
ProductName: Qper1 Internet Browser
ProductVersion: 11.01
Translation: 0x0409 0x04b0

VHO:Trojan.Win32.Diple also known as:

How to remove VHO:Trojan.Win32.Diple?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.