Categories: Spy

Win32/Spy.Delf.QWP removal tips

The Win32/Spy.Delf.QWP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Spy.Delf.QWP virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Creates a copy of itself
  • Deletes executed files from disk
  • Harvests cookies for information gathering

How to determine Win32/Spy.Delf.QWP?


File Info:

name: 7A1A5F63A716CE060892.mlwpath: /opt/CAPEv2/storage/binaries/e4d34972b9db69f661425d869590775cddb09cd61e45bb168c8cfb17d13a086dcrc32: 27269D41md5: 7a1a5f63a716ce0608926ef51c9ebc0csha1: f9acc2412b8d949fc139ffb182c2aca417a9574asha256: e4d34972b9db69f661425d869590775cddb09cd61e45bb168c8cfb17d13a086dsha512: 940dd7fed916752667817a4ad54d52fa5a133b68abbb62edf70279243f81b636cc4cecd2c741380a93b9a8a80fc0e32703cb239e0bfddb1763cb738169ff0806ssdeep: 1536:X0j+84T8bivhkKCoVRpfujc/YwmXKeXWhAaG8xDMmWoQUnUo2b:X0v4Yb2eruGgAaeXWhTj+ftype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18E83028DE24A4C45D879C7F11322A73B2CE57C822A79C70F1C1225F62AF6BB64C5B719sha3_384: b1873f560c946e932fe24ff0de35ffa2d6124c281a48966cc54a91f881ac6c8496f29f6e9396c8c335ef975db3b988beep_bytes: 60be00a042008dbe0070fdffc78708d7timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Win32/Spy.Delf.QWP also known as:

Bkav W32.AIDetect.malware2
Elastic malicious (moderate confidence)
DrWeb Trojan.Siggen3.61405
MicroWorld-eScan Trojan.Agent.CGVL
FireEye Generic.mg.7a1a5f63a716ce06
CAT-QuickHeal Trojan.GenericIH.S24070444
McAfee Artemis!7A1A5F63A716
Cylance Unsafe
VIPRE Trojan.Agent.CGVL
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0040eff71 )
K7GW Trojan ( 0059716d1 )
Arcabit Trojan.Agent.CGVL
BitDefenderTheta AI:Packer.645D753C23
Cyren W32/Legendmir.JCFQ-5826
Symantec W32.HLLP.Philis
ESET-NOD32 a variant of Win32/Spy.Delf.QWP
APEX Malicious
ClamAV Win.Trojan.Lmir-24
Kaspersky Trojan-GameThief.Win32.Lmir.oa
BitDefender Trojan.Agent.CGVL
NANO-Antivirus Trojan.Win32.Lmir.dxaowj
Avast Win32:Evo-gen [Trj]
Tencent Virus.Win32.Syphilis.a
Ad-Aware Trojan.Agent.CGVL
Sophos W32/LegMir-BM
Comodo TrojWare.Win32.PSW.Legendmir.OA@3b0u
Baidu Win32.Trojan-PSW.OLGames.be
Zillya Trojan.Lmir.Win32.762
TrendMicro PE_LEGMIR.B
McAfee-GW-Edition PWS-CangKu
Trapmine malicious.moderate.ml.score
Emsisoft Trojan.Agent.CGVL (B)
SentinelOne Static AI – Malicious PE
Jiangmin Trojan.PSW.LMir.ec
Webroot W32.Malware.Gen
Google Detected
Avira W32/PSW.Lmir.oa
Antiy-AVL Trojan/Generic.ASMalwS.206
Microsoft Trojan:Win32/Wacatac.B!ml
ViRobot Trojan.Win32.A.PSW-Lmir.212992[UPX]
GData Win32.Trojan.PSE1.BP07YY
Cynet Malicious (score: 100)
AhnLab-V3 Win32/Lemir.212992
VBA32 Trojan.Sabsik.FL
ALYac Trojan.Agent.CGVL
MAX malware (ai score=82)
Malwarebytes Malware.AI.2382208213
TrendMicro-HouseCall PE_LEGMIR.B
Rising Trojan.PSW.Qiji.s (TFE:5:etY0vUvUINB)
Yandex Trojan.GenAsa!l4kdDOnxqiQ
TACHYON Virus/W32.Philis
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:Evo-gen [Trj]
Cybereason malicious.3a716c

How to remove Win32/Spy.Delf.QWP?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

Trojan.Win32.Agent.xboakk removal

The Trojan.Win32.Agent.xboakk is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

About “Worm.Win32.Vobfus.efoh” infection

The Worm.Win32.Vobfus.efoh is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Generic.Malware.Lco.500CC679 removal tips

The Generic.Malware.Lco.500CC679 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Trojan:Win32/Plugx.B malicious file

The Trojan:Win32/Plugx.B is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Should I remove “Malware.AI.4180628677”?

The Malware.AI.4180628677 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Application.Tool.Camerashy.A (file analysis)

The Application.Tool.Camerashy.A is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago