Should I remove “Win32/TrojanDropper.Agent.QAB”?

The Win32/TrojanDropper.Agent.QAB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDropper.Agent.QAB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• A named pipe was used for inter-process communication
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Creates a hidden or system file

How to determine Win32/TrojanDropper.Agent.QAB?

File Info:
name: 795B20AAFBBCC5121102.mlw
path: /opt/CAPEv2/storage/binaries/0ed2d32f1c1c03cd8645d6bd066b6b5dd98b00bd5f82774a240b86c99a9f8281
crc32: 6C2FBBFD
md5: 795b20aafbbcc512110263ef85177cf5
sha1: 1f443329491957678222336cf982ce0c2552fccb
sha256: 0ed2d32f1c1c03cd8645d6bd066b6b5dd98b00bd5f82774a240b86c99a9f8281
sha512: 4b1a1101e10a4d7763053ee1dd27ff4a5713a3bb53879618817f4184330c029901ea1e3402a0ebf79fb685e531931ab8ce100d363f5eec942bc282901965157a
ssdeep: 3072:zP3o/ufgfaFMbK3MFN4/cudLUu/4x0lhZ8nTxjDCWMpmPkR2U+tR3dDMm2WKis:zgmfgAwZjxFMMPkRsflBKP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17FC37C91FF0B183DF6080079ECA9CB5FAD5AB5D483AD56C5E2882E60CFF356852913C9
sha3_384: c6d62f8c2f1e2f31011a83757adcde3c09f16ec1221c50b879defaebed39a33769682c281ff1e819e3d077069842b3ac
ep_bytes: 558bec6aff6868c24000688eb3400064
timestamp: 2012-12-07 02:24:11

Version Info:
0: [No Data]

Win32/TrojanDropper.Agent.QAB also known as:

How to remove Win32/TrojanDropper.Agent.QAB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.