AdWare.Win32.Agent.xxzamc removal

The AdWare.Win32.Agent.xxzamc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Agent.xxzamc virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine AdWare.Win32.Agent.xxzamc?

File Info:
name: 992C1BFB1111C782DE4D.mlw
path: /opt/CAPEv2/storage/binaries/116efa370811dfb5ebbfa7b12c43ab9c678f164ac229ede9a7bd5cd96f4219a2
crc32: 0E8B629D
md5: 992c1bfb1111c782de4d296bcef23692
sha1: bbfc4407bdeaaa32ff68d98749eee2d0b8a8a297
sha256: 116efa370811dfb5ebbfa7b12c43ab9c678f164ac229ede9a7bd5cd96f4219a2
sha512: 70818b135844d1a9dc2ccb9ee551501927a3f63ebd4108239cf251821d96a13a1d5ff1b632767c769eedd12cf744788d89bc1e7c4c842184b887c422cc83b157
ssdeep: 24576:dyrqvrHhscMadHlGiXTYVRX3gGkEaHNYK3V7oy3NVzLnK:deqvCc3FGiXTYTHgGNaDU6NVnK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B38522AE5F40AF0FCC015134A009DE7993812EBCA484CB55ADE9BD77B0FF4629D740AA
sha3_384: 23e00d56c32b878283b10fb05e0d01d74b6fdfa6fb4ac9c79a1dfc51fe181a663c9dd034102e2f71250554e7002f3e0f
ep_bytes: 6801605d00e801000000c3c3a4c4afcd
timestamp: 2021-12-06 15:40:47

Version Info:
CompanyName: Huge Co Ltd
FileDescription: Huge BRUSH 
FileVersion: 1.0.0.1
InternalName: HugeBRUSH.exe
LegalCopyright: Copyright 2021.
OriginalFilename: HugeBRUSH.exe
ProductName: HugeBRUSH
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

AdWare.Win32.Agent.xxzamc also known as:

How to remove AdWare.Win32.Agent.xxzamc?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.