home

admnfd.sys

Ad@TrustMedia

Adtrustmedia, LLC

The file admnfd.sys, “Network fitler driver” by Adtrustmedia has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a Windows kernel mode device driver named “admnfd”.
Publisher:
Windows (R) Win 7 DDK provider  (signed by Adtrustmedia, LLC)

Product:
Ad@TrustMedia

Description:
Network fitler driver

Version:
3.0.80.0 built by: WinDDK

MD5:
b507743f70e3672413e4355fe1876776

SHA-1:
49bf3074d9bf4450bb606abfbf37d4101ba0d444

SHA-256:
719db55583565069e9cfc117179ae38a77544d5c2c713a9e6a3e9ed3d2d00c4e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Displays advertising 'Trusted Advertisements' in the user's web browser in pages that normally would not show ads. Ads from AdTrustMedia are indicated by "AT-M Ad" displayed on the bottom right of the advertisement.

Analysis date:
5/12/2025 4:37:14 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Adtrustmedia (M)
16.1.24.10

File size:
50.9 KB (52,080 bytes)

Product version:
6.1.7600.16385

Copyright:
Copyright © Ad@TrustMedia 2012-2014. All rights reserved.

Original file name:
admnfd@.sys

File type:
Driver (Win32 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\admnfd.sys

Digital Signature
Signed by:
Adtrustmedia, LLC

Authority:
COMODO CA Limited

Valid from:
3/18/2015 9:00:00 PM

Valid to:
12/31/2015 9:59:59 PM

Subject:
CN="Adtrustmedia, LLC", O="Adtrustmedia, LLC", STREET="41 Watchung Plaza \#330", L=Montclair, S=New Jersey, PostalCode=07042, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
55A8A637287BFE69A0D09B9FA473C126

File PE Metadata
Compilation timestamp:
3/20/2015 11:32:13 AM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
1536:V5Gda+C7NdY+ycwIykekekekekekekek5d2hNK:V5Gda+C5dY+yHkekekekekekekek5dgK

Entry address:
0xC03E

Entry point:
8B, FF, 55, 8B, EC, E8, BD, FF, FF, FF, 5D, E9, 20, 50, FF, FF, CC, CC, 90, C1, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, BE, C4, 00, 00, DC, 80, 00, 00, B4, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 14, C5, 00, 00, 00, 80, 00, 00, E8, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 94, C9, 00, 00, 34, 80, 00, 00, C4, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 64, CA, 00, 00, 10, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, EC, C4, 00, 00, 00, C5, 00, 00, D8, C4...
 
[+]

Code size:
28 KB (28,672 bytes)

Driver
Display name:
admnfd

Type:
Kernel device driver (KernelDriver)

Group:
PNP_TDI


Remove admnfd.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.