How to remove “Win32/Adware.HPDefender.MM”?

The Win32/Adware.HPDefender.MM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Adware.HPDefender.MM virus can do?

Executable code extraction
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32/Adware.HPDefender.MM?


File Info:
crc32: 542874F1
md5: ac11ea89729ed838e09b8494f2320ae8
name: AC11EA89729ED838E09B8494F2320AE8.mlw
sha1: 440386860973ec20e8a05187e4ad5afedb48ca1c
sha256: 1e030caa81aa6bb944c12937dec18dfc95ea03b392c6f421849c2892438a3a44
sha512: 68aa4338e8a6f6701025f4f0382e76167bcc7907681b69ba2d61dc9771bdbd82e66b86a126a07a9537ed4d0bcd5844ca5d746c06167e20b927e6d52b60202d51
ssdeep: 3072:G7IfmH7thE2YYFECOoWpYxNTJGV1neun5wubqgD353u4rB:G7ImHMsECOoKY0Xfdb93537
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 JYUVCYYFIO. All rights reserved.
InternalName: OLOFPENHEN
FileVersion: 4.0.126.30184
CompanyName: JYUVCYYFIO
ProductName: Kirfo
ProductVersion: 4.0.126.30184
FileDescription: Owmy utjyy JLUUNIIHO
OriginalFilename: OLOFPENHEN.exe
Translation: 0x0409 0x04b0

Win32/Adware.HPDefender.MM also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 0056e8ea1 )
Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 99)
ALYac	Trojan.EmotetU.Gen.hq0@h0fyqVl
Cylance	Unsafe
Sangfor	Suspicious.Win32.Evo.atgen
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	AdWare:Win32/HPDefender.17c560b4
K7GW	Trojan ( 0056e8ea1 )
Cybereason	malicious.9729ed
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Adware.HPDefender.MM
APEX	Malicious
Avast	Win32:Adware-gen [Adw]
BitDefender	Trojan.EmotetU.Gen.hq0@h0fyqVl
NANO-Antivirus	Trojan.Win32.HPDefender.evexyg
MicroWorld-eScan	Trojan.EmotetU.Gen.hq0@h0fyqVl
Tencent	Win32.Trojan.Crypt.Lmkf
Ad-Aware	Trojan.EmotetU.Gen.hq0@h0fyqVl
Sophos	Generic PUA EE (PUA)
Comodo	ApplicUnwnt@#up08s2jp57lj
BitDefenderTheta	AI:Packer.077817CD20
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	GenericRXAQ-GR!AC11EA89729E
FireEye	Generic.mg.ac11ea89729ed838
Emsisoft	Trojan.EmotetU.Gen.hq0@h0fyqVl (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Crypt.XPACK.Gen7
Microsoft	Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware	Trojan.Agent/Gen-Festo
GData	Trojan.EmotetU.Gen.hq0@h0fyqVl
McAfee	GenericRXAQ-GR!AC11EA89729E
MAX	malware (ai score=100)
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Trj/Genetic.gen
Rising	Trojan.Kryptik!1.D330 (CLASSIC)
Yandex	Trojan.GenAsa!CUxM9p3U1Kw
Ikarus	Trojan.Crypt
Fortinet	W32/Generic.AP.27128!tr
AVG	Win32:Adware-gen [Adw]
Paloalto	generic.ml

How to remove Win32/Adware.HPDefender.MM?

Win32/Adware.HPDefender.MM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X