About “Win32/Agent.PAP” infection

The Win32/Agent.PAP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Agent.PAP virus can do?

The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Win32/Agent.PAP?


File Info:
crc32: 9B277303
md5: 38629c3a5d0fdc7d72c3727f5bfc5a3b
name: 38629C3A5D0FDC7D72C3727F5BFC5A3B.mlw
sha1: 7d9b9784799ac81595d3a96c642df9da3ca23357
sha256: b0224e29923482d3cb4db20b7b68f6aba0d3c731995dbf02bb4fc1e5875379f6
sha512: ed116bdcb1f53177fbc4223ece1f13117ad8ebfb940062e933fdc3f8d3fcb08050c96dbbd2ccba4963e39297d54fde71add8177685cc740b5af21cbad2ea6b3b
ssdeep: 3072:CR+SmnqOhgSew/P+SSSSSSSSSSSSSSSSSSSSSSSSSSSS5HSSSSSSSUSSSSSSSSS7:Pq6/u0Sqb50TLkDAcEbMmHrEyhm
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
LegalCopyright: Copyleft 1998-2006 by Don HO
InternalName: npp.exe
FileVersion: 6.3
CompanyName: Don HO don.h@free.fr
ProductName: Notepad++
ProductVersion: 6.3
FileDescription: Notepad++ : a free (GNU) source code editor
OriginalFilename: Notepad++.exe

Win32/Agent.PAP also known as:

K7AntiVirus	Trojan ( 700000121 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Packed.24182
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.40761395
Zillya	Trojan.Injector.Win32.186681
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Trojan ( 700000121 )
Cybereason	malicious.a5d0fd
Cyren	W32/Agent.SY.gen!Eldorado
Symantec	Trojan.Gen
ESET-NOD32	Win32/Agent.PAP
APEX	Malicious
Avast	MSIL:Agent-ADI [Trj]
ClamAV	Win.Packed.Darkkomet-6726316-0
Kaspersky	HEUR:Backdoor.MSIL.Androm.gen
BitDefender	Trojan.GenericKD.40761395
MicroWorld-eScan	Trojan.GenericKD.40761395
Tencent	Malware.Win32.Gencirc.10b6113e
Ad-Aware	Trojan.GenericKD.40761395
Sophos	ML/PE-A
Comodo	TrojWare.Win32.Lethic.DY@5reprn
TrendMicro	TROJ_SPNR.30HR13
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.38629c3a5d0fdc7d
Emsisoft	Trojan.GenericKD.40761395 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Jorik.gote
Avira	TR/Jorik.Lethic.EB
eGambit	Unsafe.AI_Score_99%
Microsoft	Backdoor:Win32/Bladabindi!ml
Arcabit	Trojan.Generic.D26DF833
SUPERAntiSpyware	Trojan.Agent/Gen-Fake[Plus]
GData	Trojan.GenericKD.40761395
AhnLab-V3	Backdoor/Win32.DarkKomet.R62460
McAfee	Artemis!38629C3A5D0F
MAX	malware (ai score=83)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.3715112713
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_SPNR.30HR13
Ikarus	Trojan.Win32.Jorik
MaxSecure	Trojan.Malware.4973904.susgen
Fortinet	MSIL/Injector.IFC!tr
AVG	MSIL:Agent-ADI [Trj]

How to remove Win32/Agent.PAP?

Win32/Agent.PAP removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X