BAT/Agent.PGK removal guide

The BAT/Agent.PGK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BAT/Agent.PGK virus can do?

Presents an Authenticode digital signature
Possible date expiration check, exits too soon after checking local time
Drops a binary and executes it
Unconventionial language used in binary resources: Icelandic
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine BAT/Agent.PGK?


File Info:
crc32: 74C033BE
md5: 2e97bae99824a19e9bb834dc126c7aa8
name: 2E97BAE99824A19E9BB834DC126C7AA8.mlw
sha1: 07c5ddb1652394f517603729e45aee7f74595b05
sha256: d147085a0bdc76c5bcd880e6163691b70c728afb6be1da952adf8ab98e43af06
sha512: 8a957a8d0fd7984e4f4d680ba03891e99e3dc2c5520e3a56c02d9b1d5d048dbf3b3e4106e8accf1b9b682b2afe641282263d31ace03d2e5bda4c968535db9600
ssdeep: 24576:1mZprpe+ojcAVY0jJhrsrOhiXpIUHBBpziZMvLn:AZVs+8ckwOhjQHRPD
type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive

Version Info:
LegalCopyright: Copyright xa9 2009-2018 Marc Ochsenmeier
InternalName: pestudio.exe
FileVersion: 8, 81, 0, 0
CompanyName: www.winitor.com
LegalTrademarks: www.winitor.com
Comments: Malware Initial Assessment
ProductName: pestudio
ProductVersion: 8, 81, 0, 0
FileDescription: Malware Initial Assessment - www.winitor.com
OriginalFilename: pestudio.exe
Translation: 0x0000 0x04b0

BAT/Agent.PGK also known as:

Elastic	malicious (high confidence)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_70% (W)
ESET-NOD32	BAT/Agent.PGK
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Backdoor.Win32.Agent
FireEye	Generic.mg.2e97bae99824a19e
Webroot	W32.Malware.Gen
eGambit	PE.Heur.InvalidSig
Microsoft	Ransom:Win32/CONTI!ml
Gridinsoft	Trojan.Win32.Agent.oa!s1
Malwarebytes	Trojan.MalPack

How to remove BAT/Agent.PGK?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

BAT/Agent.PGK removal guide