Downloader.Win32.Agent.kehz removal instruction

The Downloader.Win32.Agent.kehz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Downloader.Win32.Agent.kehz virus can do?

• Sample contains Overlay data
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Touches a file containing cookies, possibly for information gathering
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Downloader.Win32.Agent.kehz?

File Info:
name: AFB34E5FFBB1EBE8B53E.mlw
path: /opt/CAPEv2/storage/binaries/b86d1e49fa910cf19fbe80105926f3f9ca50232882ccddf883f4825147dc5267
crc32: 245403E1
md5: afb34e5ffbb1ebe8b53e1a8ea4bfda34
sha1: aa640ded0f092bf7e167806338ff2d0f56a29811
sha256: b86d1e49fa910cf19fbe80105926f3f9ca50232882ccddf883f4825147dc5267
sha512: 028a0e5623ac08366bdca275e242edba0bfac60d87ee3bdb3c9f724d59b04efcd421733d290bb8cb30a7ea84cb4686052508f818ebf1735221a8f80ea48714cf
ssdeep: 6144:B017vY/DQmGLkT0kFDVDfvTLILBBJTBRQI3LGU+EHZCUa7WIp/opN:BCw/DQmGLkTRFD+DJT339VZBa7dpApN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E4B4171F97548332D16009375CDB8370AC2E6D603AE77CF62D992E0F8B79682B53D692
sha3_384: 9f3d3ce22d697ca6a947acb0c03f6811c7b5a9e8c883820d08dafb959089cf8e08adb71698c4a380b9ac7263a31b5d99
ep_bytes: 558bec83c4f0b84ccb4400e89c98fbff
timestamp: 2017-11-27 10:17:04

Version Info:
CompanyName: TweakBit
FileDescription: PCRepairKit Setup
FileVersion: 1.8.3.2
InternalName: pc-repair-kit
LegalCopyright: Copyright © 2008-2017 Auslogics Labs Pty Ltd
LegalTrademarks: Copyright © 2008-2017 Auslogics Labs Pty Ltd
OriginalFilename: pcrepairkit_stub_installer.exe
ProductName: PCRepairKit
ProductVersion: 1.x
Comments: Part of TweakBit PC Repair Kit
Translation: 0x0409 0x04e4

Downloader.Win32.Agent.kehz also known as:

How to remove Downloader.Win32.Agent.kehz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.