AdWare.Win32.Agent.xxyqfk (file analysis)

The AdWare.Win32.Agent.xxyqfk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Agent.xxyqfk virus can do?

Presents an Authenticode digital signature
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Queries information on disks, possibly for anti-virtualization
Network activity contains more than one unique useragent.
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

api.ip138.com

ab.popodi.com

a.tomx.xyz

down.xiald.com

down.popodi.com

www.9973.com

xzqtj.xiald.com

How to determine AdWare.Win32.Agent.xxyqfk?


File Info:
crc32: AB3DEC74
md5: ff549cf33960f0af24eef8fd25ccaf4e
name: ____________3___________________131_457150.exe
sha1: 8f700c74c9a518889fa625b9d5c1839ac26fc2b7
sha256: b12b986add0a4fd3b86226381b1ab3586c28c5eb361eb43ee6c342f0867a5489
sha512: 55ec3cbcf1ab883102908ec341e7226eb74e6d75f5c011815509e4ab22a229ca125999ea745684bfac59b4abd3709039ba6b851367a8d173f05e42ba84a9908a
ssdeep: 49152:kzLVynqoiJE0O7Pfjouypc8ILJ0Yzr0uetadb7rzHWnsghMYj:6MqouOvouyp7oSueta9nSnsw
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2018
InternalName: x9ad8x901fx4e0bx8f7dx5668
FileVersion: 1.5.2.19924
CompanyName: x9ad8x901fx4e0bx8f7dx5668
ProductName: x9ad8x901fx4e0bx8f7dx5668
ProductVersion: 1,5,2,19924
FileDescription: x9ad8x901fx4e0bx8f7dx5668
OriginalFilename: Install.exe
Translation: 0x0804 0x04b0

AdWare.Win32.Agent.xxyqfk also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Trojan.GenericKD.32669377
FireEye	Generic.mg.ff549cf33960f0af
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	GenericRXJC-ZY!FF549CF33960
ALYac	Trojan.GenericKD.32669377
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Adware ( 004d97001 )
BitDefender	Trojan.GenericKD.32669377
K7GW	Adware ( 004d97001 )
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Softcnapp.J potentially unwanted
APEX	Malicious
GData	Trojan.GenericKD.32669377
Kaspersky	not-a-virus:AdWare.Win32.Agent.xxyqfk
Alibaba	AdWare:Win32/Softcnapp.208c9ce1
ViRobot	Adware.Agent.2511784
Avast	Win32:AdwareX-gen [Adw]
Tencent	Malware.Win32.Gencirc.10b0bbe3
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.32669377 (B)
DrWeb	Adware.Softcnapp.119
Zillya	Adware.Agent.Win32.145969
McAfee-GW-Edition	GenericRXJC-ZY!FF549CF33960
Sophos	Generic PUA IP (PUA)
Jiangmin	Adware.Agent.akso
MAX	malware (ai score=89)
Antiy-AVL	GrayWare[AdWare]/Win32.Agent
Arcabit	Trojan.Generic.D1F27EC1
AhnLab-V3	PUP/Win32.Softcnapp.R293787
ZoneAlarm	not-a-virus:AdWare.Win32.Agent.xxyqfk
Microsoft	PUA:Win32/CoinMiner
VBA32	BScope.Adware.Puwaders
Ad-Aware	Trojan.GenericKD.32669377
Malwarebytes	PUP.Optional.Softcnapp
Rising	Adware.Downloader!1.BBEC (CLOUD)
Yandex	PUA.Agent!
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.73379846.susgen
Fortinet	Adware/Agent
Webroot	W32.Adware.Gen
AVG	Win32:AdwareX-gen [Adw]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_60% (D)

How to remove AdWare.Win32.Agent.xxyqfk?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

AdWare.Win32.Agent.xxyqfk (file analysis)