Categories: Trojan

NSIS/TrojanDropper.Agent.BT removal tips

The NSIS/TrojanDropper.Agent.BT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What NSIS/TrojanDropper.Agent.BT virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Tries to unhook or modify Windows functions monitored by Cuckoo
Installs itself for autorun at Windows startup
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

fget-career.com

bing.com

yahoo.com

www.qq5.com

How to determine NSIS/TrojanDropper.Agent.BT?


File Info:
crc32: 4C85DB3Emd5: f14400627d9a38e81fb94001f6b69b3bname: shishangzuikengdiedieluosifangkuai.exesha1: ab1060d205a630e4e9a90161a66e0e19d1f70309sha256: f520501650dfd4a7153beb585b91802bd80358ed830d821e3677550312460a66sha512: a50560664a0f62f455736f762dc29ccf074aed701ba4a2a56bdff5045b563a480d95ca4ee69b3451073c4bf19d7cc13c4616fdaa3e4d4c0a9495c7e059537b45ssdeep: 196608:Vgiyw5wzOXtL6UGZ2XnuQv938jScwGflEHd:+5awkTu+8jtlEHdtype: PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Version Info:
LegalCopyright: (C)ProductName: FileVersion: FileDescription: Producer shdTranslation: 0x0804 0x04e4

NSIS/TrojanDropper.Agent.BT also known as:

MicroWorld-eScan	Trojan.GenericKD.31747835
FireEye	Generic.mg.f14400627d9a38e8
CAT-QuickHeal	W32.Ramnit.A
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Virus.Win32.Nimnul.n!c
Sangfor	Malware
CrowdStrike	win/malicious_confidence_80% (W)
BitDefender	Trojan.GenericKD.31747835
K7GW	Trojan ( 0050b64b1 )
K7AntiVirus	Trojan ( 0050b64b1 )
Invincea	heuristic
Baidu	Multi.Threats.InArchive
F-Prot	W32/Ramnit.B!Generic
Symantec	W32.Ramnit!inf
APEX	Malicious
Avast	Win32:RmnDrp
ClamAV	Win.Trojan.Ramnit-1847
GData	Trojan.GenericKD.31747835
Kaspersky	Virus.Win32.Nimnul.a
Alibaba	Virus:Win32/Nimnul.b8264b25
NANO-Antivirus	Virus.Win32.Ramnit.eslalb
Tencent	Malware.Win32.Gencirc.10b3ee0c
Ad-Aware	Trojan.GenericKD.31747835
Emsisoft	Adware.Dropper (A)
Comodo	Malware@#29ishag43kmmv
F-Secure	Malware.W32/Ramnit.CD
DrWeb	Adware.Searcher.1222
Zillya	Trojan.Zbot.Win32.188716
TrendMicro	PE_RAMNIT.H
McAfee-GW-Edition	BehavesLike.Win32.Virus.vc
Trapmine	malicious.high.ml.score
Sophos	W32/Patched-I
Ikarus	Virus.Ramnit
Cyren	W32/Ramnit.B!Generic
Jiangmin	Win32/PatchFile.et
MaxSecure	Virus.Nimnul.A
Avira	W32/Ramnit.CD
MAX	malware (ai score=100)
Antiy-AVL	GrayWare/Win32.StartPage.gen
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D1E46EFB
ZoneAlarm	Virus.Win32.Nimnul.a
Microsoft	Virus:Win32/Ramnit.A
BitDefenderTheta	AI:FileInfector.EAEEA7850C
ALYac	Trojan.GenericKD.31747835
VBA32	Adware.Searcher
Malwarebytes	Trojan.ChinAd
Panda	Generic Suspicious
Zoner	Trojan.Win32.Ramnit.23698
ESET-NOD32	a variant of NSIS/TrojanDropper.Agent.BT
TrendMicro-HouseCall	PE_RAMNIT.H
Rising	Virus.Ramnit!1.9AA5 (CLASSIC)
SentinelOne	DFI – Malicious PE
Fortinet	W32/Agent.BT!tr
Webroot	W32.Malware.Heur
AVG	Win32:RmnDrp
Cybereason	malicious.27d9a3
Paloalto	generic.ml
Qihoo-360	Win32/Virus.IM.0e1