About "AdWare.Win32.Agent.xxyqit" infection

The AdWare.Win32.Agent.xxyqit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Agent.xxyqit virus can do?

Presents an Authenticode digital signature
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Queries information on disks, possibly for anti-virtualization
Network activity contains more than one unique useragent.
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

api.ip138.com

dwoncdn.xiald.com

a.tomx.xyz

down.xiald.com

dwoncdn2.xiald.com

www.9973.com

xzqtj.xiald.com

How to determine AdWare.Win32.Agent.xxyqit?


File Info:
crc32: F2D41A18
md5: 4d18eb8b5771affab64913e41267eb69
name: vs_________visual_131_124481.exe
sha1: 1c505105cb9e76b9c30bbc8d5aef343702f04ceb
sha256: a045bb8436dda56ba045992e257265c13d4f1461efe350184675bf106dc829da
sha512: e9102a8b72af56f5d59a4adb010831f5a549b84e8d5bcb100a57264d35527f13954dbbdcd88b0ef854c21641eb761152288d862544b6764047cb1bb62c474cba
ssdeep: 49152:0XEOLgpwbnGLsE7/mlIdUycwe+YwYTZuetadb7HHWnAh45LQ:UUpwbnGJ7/mlI6ycwkVueta9anA9
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2018
InternalName: x9ad8x901fx4e0bx8f7dx5668
FileVersion: 1.5.7.191025
CompanyName: x9ad8x901fx4e0bx8f7dx5668
ProductName: x9ad8x901fx4e0bx8f7dx5668
ProductVersion: 1,5,7,191025
FileDescription: x9ad8x901fx4e0bx8f7dx5668
OriginalFilename: Install.exe
Translation: 0x0804 0x04b0

AdWare.Win32.Agent.xxyqit also known as:

Bkav	W32.AIDetectVM.malware
DrWeb	Adware.Softcnapp.119
MicroWorld-eScan	Gen:Variant.Jatif.627
FireEye	Generic.mg.4d18eb8b5771affa
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	GenericRXJC-ZY!4D18EB8B5771
Zillya	Adware.Agent.Win32.147977
Sangfor	Malware
K7AntiVirus	Adware ( 004d97001 )
BitDefender	Gen:Variant.Jatif.627
K7GW	Adware ( 004d97001 )
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Softcnapp.J potentially unwanted
APEX	Malicious
GData	Gen:Variant.Jatif.627
Kaspersky	not-a-virus:AdWare.Win32.Agent.xxyqit
Alibaba	AdWare:Win32/Softcnapp.e4333116
ViRobot	Adware.Softcnapp.2537896
Avast	Win32:AdwareX-gen [Adw]
Tencent	Win32.Adware.Agent.Pdcq
Endgame	malicious (high confidence)
Sophos	Generic PUA BM (PUA)
Comodo	Malware@#3kimkcbf09mr9
VIPRE	Trojan.Win32.Generic!BT
Emsisoft	Gen:Variant.Jatif.627 (B)
SentinelOne	DFI – Suspicious PE
Jiangmin	Adware.Agent.akso
Microsoft	PUA:Win32/CoinMiner
Arcabit	Trojan.Jatif.627
ZoneAlarm	not-a-virus:AdWare.Win32.Agent.xxyqit
VBA32	BScope.Adware.Puwaders
MAX	malware (ai score=84)
Ad-Aware	Gen:Variant.Jatif.627
Malwarebytes	PUP.Optional.Softcnapp
Rising	Adware.Downloader!1.BBEC (CLASSIC)
Fortinet	Adware/Agent
AVG	Win32:AdwareX-gen [Adw]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_60% (D)
MaxSecure	Trojan.Malware.73379846.susgen

How to remove AdWare.Win32.Agent.xxyqit?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “AdWare.Win32.Agent.xxyqit” infection