Malware

Downloader.Win32.Agent.miej removal

Malware Removal

The Downloader.Win32.Agent.miej is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Downloader.Win32.Agent.miej virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (10 unique times)
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Collects information about installed applications
  • Checks the version of Bios, possibly for anti-virtualization
  • Attempts to modify proxy settings

Related domains:

z.whorecord.xyz
w.nanweng.cn
a.tomx.xyz
cdn.zry97.com
www.winrar.com.cn
s95.cnzz.com
s4.cnzz.com
ocsp.globalsign.com
ocsp2.globalsign.com
z11.cnzz.com
c.cnzz.com
cnzz.mmstat.com
z4.cnzz.com

How to determine Downloader.Win32.Agent.miej?


File Info:

crc32: A93BADCD
md5: 3b0860408e0ac4059b2fc5990d35ffc7
name: E68891E79A84E4B896E7958C20121_8054.exe
sha1: c81dd838d51266ea7de4f302191c992dd8e8688c
sha256: dfdb4249db7441afb1c062c13648771fa7d58118db79b1d06e7f8b49adda67fb
sha512: 2d65f06d6dc842e589e82396500ad563674439e718474b6f9d9bdfa2a39b660219ebdde79422e0ceb4a44d9c3fd7e9d04ab3c1674abcc1b4b40e665266d6c808
ssdeep: 24576:LiUoh5ZjHbbh0cXRNvC3EoMTi5TuwL9tirIEJLGVL7ZZGdL:LiU+ZTb3vCsTCLvirJLoHZcd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2020
InternalName: x667ax80fdx4e0bx8f7dx5668.exe
FileVersion: 5.0.0.0422
ProductName: x667ax80fdx4e0bx8f7dx5668.exe
FileDescription: _
OriginalFilename: x667ax80fdx4e0bx8f7dx5668.exe
Translation: 0x0804 0x04b0

Downloader.Win32.Agent.miej also known as:

DrWebAdware.Qjwmonkey.168
MicroWorld-eScanGen:Variant.Johnnie.237640
FireEyeGeneric.mg.3b0860408e0ac405
McAfeeGenericRXKJ-DA!3B0860408E0A
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusAdware ( 005105151 )
BitDefenderGen:Variant.Johnnie.237640
K7GWAdware ( 005105151 )
CyrenW32/Adware.UJXR-3025
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Adware-gen [Adw]
GDataGen:Variant.Johnnie.237640
Kasperskynot-a-virus:Downloader.Win32.Agent.miej
AlibabaAdWare:Win32/Qjwmonkey.283a8f05
Endgamemalicious (high confidence)
SophosGeneric PUA MI (PUA)
ComodoApplicUnwnt@#3sg1b3h73iim0
F-SecureAdware.ADWARE/AD.QjwMonkey
McAfee-GW-EditionArtemis!Trojan
EmsisoftGen:Variant.Johnnie.237640 (B)
IkarusPUA.Qjwmonkey
WebrootW32.Adware.Gen
AviraADWARE/AD.QjwMonkey.drycn
Antiy-AVLGrayWare/Win32.Qjwmonkey
ArcabitTrojan.Johnnie.D3A048
ZoneAlarmnot-a-virus:Downloader.Win32.Agent.miej
MicrosoftPUA:Win32/Qjwmonkey
AhnLab-V3PUP/Win32.Installer.C4084287
VBA32BScope.Adware.Qjwmonkey
MAXmalware (ai score=99)
Ad-AwareGen:Variant.Johnnie.237640
MalwarebytesAdware.ChinAd
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Adware.Qjwmonkey.H
TrendMicro-HouseCallTROJ_GEN.R002H0CE120
RisingAdware.Qjwmonkey!1.C54A (CLOUD)
eGambitUnsafe.AI_Score_100%
FortinetRiskware/Generic_PUA_MI
AVGWin32:Adware-gen [Adw]
Paloaltogeneric.ml
MaxSecureTrojan.Malware.121218.susgen

How to remove Downloader.Win32.Agent.miej?

Downloader.Win32.Agent.miej removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment