Win32/TrojanDownloader.Agent.GFH removal guide

The Win32/TrojanDownloader.Agent.GFH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/TrojanDownloader.Agent.GFH virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Attempts to modify proxy settings

How to determine Win32/TrojanDownloader.Agent.GFH?


File Info:
name: BBBCD871613139B915D0.mlw
path: /opt/CAPEv2/storage/binaries/f295e5a5a37f135ada5151e77513f5b4550c0136d2f8ed8c71ac20e771724127
crc32: A349C73E
md5: bbbcd871613139b915d019539003ca07
sha1: 88e032423e0265e11c51ff4bd8b7819a81d975c3
sha256: f295e5a5a37f135ada5151e77513f5b4550c0136d2f8ed8c71ac20e771724127
sha512: 2402bdcf612bc61b455f1e45720c3d9351f082c3b6cc7af3148574962aead2b6e7d410d53d2ec5ff54e9b49421202ff60660b355269e9776dcfb13beb1480f52
ssdeep: 3072:YZHRmZB6fY+7ANTgFKqqEjk+OplZlSFpGemgokAnSt5/Zyt+2YjjPy:IHW0fYWAaQNmk+uLlS9zGY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12E349E2335E0C4BBC6A311714FD69BFFF2B6FD100F629A4327A09B2D6D3159286361A5
sha3_384: 8ccf52aaa18a2cd8521f4de018ee5b4359d1ce5d1f92af8d5051ce3dbb0e73317355f6cb6ee6f45942c721713372bea4
ep_bytes: 558bec6aff68209842006850d2400064
timestamp: 2022-05-04 07:35:11

Version Info:
CompanyName: 
FileDescription: AA2 Microsoft 基础类应用程序
FileVersion: 1, 0, 0, 1
InternalName: AA2
LegalCopyright: 版权所有 (C) 2022
LegalTrademarks: 
OriginalFilename: AA2.EXE
ProductName: AA2 应用程序
ProductVersion: 1, 0, 0, 1
Translation: 0x0804 0x04b0

Win32/TrojanDownloader.Agent.GFH also known as:

Lionic	Trojan.Win32.Farfli.m!c
MicroWorld-eScan	Trojan.GenericKD.49355258
FireEye	Generic.mg.bbbcd871613139b9
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
Zillya	Downloader.Agent.Win32.470314
Sangfor	Downloader.Win32.Farfli.Vw3l
K7AntiVirus	Trojan-Downloader ( 005907be1 )
Alibaba	Backdoor:Win32/Farfli.a338687f
K7GW	Trojan-Downloader ( 005907be1 )
Cybereason	malicious.23e026
BitDefenderTheta	Gen:NN.ZexaF.34592.oq0@aOQF1sab
Cyren	W32/Kryptik.BWY.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.GFH
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.Win32.Farfli.gen
BitDefender	Trojan.GenericKD.49355258
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10d07010
Ad-Aware	Trojan.GenericKD.49355258
TACHYON	Backdoor/W32.Farfli.233472.H
Sophos	Mal/Generic-S
Comodo	Malware@#t80gczdiu02u
VIPRE	Trojan.GenericKD.49355258
TrendMicro	TROJ_GEN.R002C0WFT22
McAfee-GW-Edition	RDN/Generic Downloader.x
Trapmine	suspicious.low.ml.score
Emsisoft	Trojan.GenericKD.49355258 (B)
Ikarus	Trojan-Downloader.Win32.Agent
GData	Trojan.GenericKD.49355258
Jiangmin	Backdoor.Farfli.gbo
Google	Detected
Avira	TR/Dldr.Agent.sbglj
Antiy-AVL	Trojan/Generic.ASMalwS.26E9
Microsoft	Trojan:Win32/Zbot!mclg
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C5132972
VBA32	suspected of Trojan.Downloader.gen
ALYac	Trojan.GenericKD.49355258
MAX	malware (ai score=82)
Malwarebytes	Backdoor.Farfli
TrendMicro-HouseCall	TROJ_GEN.R002C0WFT22
Rising	Backdoor.Farfli!8.B4 (CLOUD)
Yandex	Trojan.DL.Agent!3hUDpRaqX40
MaxSecure	Trojan.Malware.73947863.susgen
Fortinet	W32/Agent.GFH!tr.dldr
AVG	Win32:Malware-gen
Panda	Trj/Chgt.AA
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32/TrojanDownloader.Agent.GFH?

Win32/TrojanDownloader.Agent.GFH removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X