Categories: Malware

Mal/Generic-R + Troj/Agent-AFSD removal instruction

The Mal/Generic-R + Troj/Agent-AFSD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Generic-R + Troj/Agent-AFSD virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Authenticode signature is invalid
Attempts to repeatedly call a single API many times in order to delay analysis time
Created a process from a suspicious location
Attempts to modify proxy settings
Anomalous binary characteristics

How to determine Mal/Generic-R + Troj/Agent-AFSD?


File Info:
name: 95FC68FB7C8345FA07AC.mlwpath: /opt/CAPEv2/storage/binaries/4dbe6aef873b4f03b8a59ba94d14f33733d216ef3943545326f0f59a67ff7c46crc32: 9C99744Dmd5: 95fc68fb7c8345fa07ac412ad9731639sha1: ff11d609c58912bb326c3ae4ce0374e430308587sha256: 4dbe6aef873b4f03b8a59ba94d14f33733d216ef3943545326f0f59a67ff7c46sha512: 63807c02900fb52c4384bc497509fd78f73e9c5fc144fcff8e97ab36662d5b43d3b1a8c504e8c2b54a70e65160be7f4e7053e44993917e44cc31582f9ca80bfassdeep: 384:Iaw6ACEjSU0sofW7f6qx3qexIFyUNFwxR94calJJjjjCDAAAAAIi6sjtSGw:IN6AC07ofW5d28iwAJjjvj4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F5A21A306FD05773E3331A7B98F7A6BBA575B402F6064D4E5281F33D19336828A5226Esha3_384: 8d23ec0ba83bcd0f79d774cb928042cb7001d23ecc0dabe872f75dd94a2f9c5c733c551a9dd9d8c60dd7bb2255371773ep_bytes: 558bec83ec54ff15083040008945b48btimestamp: 2014-01-21 10:29:08
Version Info:
0: [No Data]

Mal/Generic-R + Troj/Agent-AFSD also known as:

Bkav	W32.FamVT.GeND.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.1510364
FireEye	Generic.mg.95fc68fb7c8345fa
CAT-QuickHeal	TrojanDownloader.Upatre.A4
ALYac	Trojan.GenericKD.1510364
Cylance	Unsafe
VIPRE	Trojan.Win32.Upatre.jr (v)
K7AntiVirus	Trojan ( 0050357f1 )
BitDefender	Trojan.GenericKD.1510364
K7GW	Trojan ( 0050357f1 )
Cybereason	malicious.b7c834
Baidu	Win32.Trojan-Downloader.Waski.a
VirIT	Trojan.Win32.Zyx.AAV
Cyren	W32/Trojan.DFXD-0733
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.Waski.A
APEX	Malicious
ClamAV	Win.Trojan.Upatre-3470
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.DownLoad3.csrzfn
Rising	Downloader.Waski!1.A489 (CLOUD)
Ad-Aware	Trojan.GenericKD.1510364
Sophos	Mal/Generic-R + Troj/Agent-AFSD
Comodo	TrojWare.Win32.Yarwi.BV@56uh49
DrWeb	Trojan.DownLoad3.28161
TrendMicro	TROJ_UPATRE.SMBX
Emsisoft	Trojan.GenericKD.1510364 (B)
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.1510364
Jiangmin	Trojan/Generic.azsea
Avira	TR/Rogue.AI.141212
Antiy-AVL	Trojan/Generic.ASMalwS.78A56A
SUPERAntiSpyware	Trojan.Agent/Downloader-Upatre
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	TrojanDownloader:Win32/Upatre.AA
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Waski.C254041
Acronis	suspicious
McAfee	Downloader-FGQ!95FC68FB7C83
MAX	malware (ai score=84)
VBA32	TrojanDownloader.Upatre
Malwarebytes	Spyware.Zbot
Panda	Generic Malware
TrendMicro-HouseCall	TROJ_UPATRE.SMBX
Tencent	Trojan.Win32.Downloader.wc
Ikarus	Trojan-Downloader.Win32.Upatre
Fortinet	W32/Waski.A!tr
BitDefenderTheta	Gen:NN.ZexaF.34212.bqX@amDn0dai
AVG	Win32:Agent-ASTB [Trj]
Avast	Win32:Agent-ASTB [Trj]
CrowdStrike	win/malicious_confidence_100% (W)