Should I remove “AutoIt:Banker-AS [Trj]”?

The AutoIt:Banker-AS [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What AutoIt:Banker-AS [Trj] virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid

How to determine AutoIt:Banker-AS [Trj]?


File Info:
name: 018AD0CE3B737F4E74B3.mlw
path: /opt/CAPEv2/storage/binaries/177b9c8c889f6237ba36859f24efaf0858ce9ab77ee2bb2d8b95aeb9c1072f09
crc32: 69D43769
md5: 018ad0ce3b737f4e74b35b66205de721
sha1: 168ee990570aa053f0dd9a3bbdf79e6db293231f
sha256: 177b9c8c889f6237ba36859f24efaf0858ce9ab77ee2bb2d8b95aeb9c1072f09
sha512: 60f8c8714bc411bdc52096797b8590985baf0cb210b15362f2153dd24ef92e3c8663b3d541db0c9be9eb5f0824d73c43f0cb8855f1062b469e7b00f7ed5383e8
ssdeep: 24576:nYAyD1ySYAenGTeX6056cBoTMqAj8w7ZUVZ/xa3HYMpGfX6uFhggL:Ypyle05PSRc9ZklxaXYro+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16F65336DBF4918C9E69B2D33649BABFD67667F801100E38F8B70CF47C5212662E1DA44
sha3_384: 9356bbf3cfe2231487ba39112a6ff552bcc2093281494c2b618fcf027b9a44ed3c22416a6c621fb3f3d6508462fa6d7c
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-12-05 22:50:46

Version Info:
Comments: Complete Preventive Maintenance
CompanyName: A+ Maintenance
FileDescription: A+ Preventive Maintenance
FileVersion: 0.9.6.5
LegalCopyright: © Christopher L. Greer
ProductName: A+ Maintenance
ProductVersion: 0.9.6.5
Translation: 0x0409 0x04e4

AutoIt:Banker-AS [Trj] also known as:

Lionic	Trojan.Win32.Generic.4!c
Cylance	unsafe
Alibaba	TrojanDownloader:AutoIt/Proxy.e869a3c8
Cynet	Malicious (score: 99)
Avast	AutoIt:Banker-AS [Trj]
F-Secure	Trojan.TR/Proxy.Gen
Ikarus	Trojan.Proxy
Jiangmin	Trojan.Agent.dvht
Avira	TR/Proxy.Gen
Antiy-AVL	Trojan[Downloader]/Win32.Agent.a
Microsoft	Program:Win32/Wacapew.C!ml
McAfee	Artemis!6E40882CB8DB
VBA32	Trojan.Autoit.F
Rising	Trojan.Obfus/Autoit!1.BEDE (CLASSIC)
AVG	AutoIt:Banker-AS [Trj]
DeepInstinct	MALICIOUS

How to remove AutoIt:Banker-AS [Trj]?

AutoIt:Banker-AS [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X