About "AutoIt:Agent-ACS [Trj]" infection

The AutoIt:Agent-ACS [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AutoIt:Agent-ACS [Trj] virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

aihdownload.adobe.com

dl.dropboxusercontent.com

ocsp.digicert.com

How to determine AutoIt:Agent-ACS [Trj]?


File Info:
crc32: ED949A5E
md5: 95e991af2975adaf34bdc7e3faa7d84f
name: 95E991AF2975ADAF34BDC7E3FAA7D84F.mlw
sha1: 31ceafb396c60f6e958d12772e33fcafac6f011b
sha256: 9fe49491a4425dfd18da91f52b1649f160dc636106b07e1a658c339b1badee9c
sha512: 9de8b570528e5e8708544460be20a6a206d4f7076aec7a86c85ed3dccaf4cd3cf1005991ba50c536f1dd56cbdb914774a1fba7c295060edaa0c59c7460dd7e7f
ssdeep: 12288:9Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1XeKhJyONFy:EhloDX0XOf47LySI
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: xa91999-2013 Jonathan Bennett & AutoIt Team
ProductVersion: 3.3.10.2
FileVersion: 15.7.6.4
Comments: http://www.autoitscript.com/autoit3/
FileDescription: Flash Adobe Installer
Translation: 0x0809 0x04b0

AutoIt:Agent-ACS [Trj] also known as:

Bkav	W32.AIDetect.malware1
DrWeb	Trojan.DownLoader14.40365
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Strictor.74429
Cylance	Unsafe
Zillya	Trojan.Blocker.Win32.21401
Alibaba	Ransom:Win32/Blocker.550c1116
Cybereason	malicious.f2975a
ESET-NOD32	multiple detections
APEX	Malicious
Avast	AutoIt:Agent-ACS [Trj]
Kaspersky	Trojan-Ransom.Win32.Blocker.egqg
BitDefender	Gen:Variant.Strictor.74429
NANO-Antivirus	Trojan.Win32.Blocker.czezjz
MicroWorld-eScan	Gen:Variant.Strictor.74429
Tencent	Malware.Win32.Gencirc.114bb687
Ad-Aware	Gen:Variant.Strictor.74429
Comodo	Malware@#ad99lve5xinw
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.hc
FireEye	Gen:Variant.Strictor.74429
Emsisoft	Gen:Variant.Strictor.74429 (B)
Webroot	Trojan.Dropper.Gen
Avira	HEUR/AGEN.1114577
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Strictor.D122BD
AegisLab	Trojan.Win32.Blocker.4!c
GData	Gen:Variant.Strictor.74429
McAfee	Artemis!95E991AF2975
MAX	malware (ai score=100)
Panda	Trj/CI.A
Ikarus	Worm.Win32.AutoIt
Fortinet	W32/Blocker.EGQG!tr
AVG	AutoIt:Agent-ACS [Trj]

How to remove AutoIt:Agent-ACS [Trj]?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “AutoIt:Agent-ACS [Trj]” infection