Categories: Malware

Troj/AutoG-IX removal instruction

The Troj/AutoG-IX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/AutoG-IX virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Injection with CreateRemoteThread in a remote process
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Attempts to interact with an Alternate Data Stream (ADS)
Anomalous binary characteristics

How to determine Troj/AutoG-IX?


File Info:
crc32: F00B2EB1md5: c90c91dde7b4015182e26f493d9229f6name: upload_filesha1: 49ae7440773de87ea3f085f085b80d56d3388b0asha256: 5de3a91f516ff756b450155641e354aebc48ff4701721dde73ef1960bf955b94sha512: 38b01c2c6b3b718b0ee2969c70bfc441a4e1918ca8c8f99fa26ab74d0beed90dbd5158334443fd2b4f7c15884d2830046f68c87afbb6e6b16ce8dcd6d81d31c5ssdeep: 12288:zqEp9L5YG8S7EdJkR5Tmj/lDQ2FHS1BXUOklrSnFiVN1Oem1P1Dq0dZUJ4kjACHF:vn5Y+7P3a/l08SorSnaS19DfZUS6y+zxtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Troj/AutoG-IX also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	BackDoor.RatNET.2
MicroWorld-eScan	Trojan.GenericKD.34396751
FireEye	Generic.mg.c90c91dde7b40151
McAfee	Fareit-FYT!C90C91DDE7B4
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056cefe1 )
BitDefender	Trojan.GenericKD.34396751
K7GW	Trojan ( 0056cefe1 )
Cybereason	malicious.0773de
TrendMicro	TROJ_GEN.R011C0DHM20
BitDefenderTheta	Gen:NN.ZelphiF.34216.7GW@auZ7Nfhi
Cyren	W32/Trojan.FOUS-7061
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Nanocore-9448230-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
Alibaba	Trojan:Win32/DelfInject.6c1200e3
NANO-Antivirus	Trojan.Win32.Kryptik.hsrfaa
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.34396751
Comodo	TrojWare.Win32.UMal.ptvpk@0
F-Secure	Trojan.TR/Injector.rocai
Zillya	Trojan.Injector.Win32.763331
Invincea	Mal/Generic-S + Troj/AutoG-IX
Sophos	Troj/AutoG-IX
SentinelOne	DFI – Suspicious PE
Jiangmin	Trojan.Kryptik.cdm
Avira	TR/Injector.rocai
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	VirTool:Win32/DelfInject.AR!MTB
Arcabit	Trojan.Generic.D20CDA4F
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.GenericKD.34396751
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.C4184495
Acronis	suspicious
VBA32	TScope.Trojan.Delf
ALYac	Trojan.GenericKD.34396751
MAX	malware (ai score=81)
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Injector.EMMA
TrendMicro-HouseCall	TROJ_GEN.R011C0DHM20
Rising	Trojan.Injector!1.CB1A (CLASSIC)
Yandex	Trojan.Injector!YCRBEDlFkok
Ikarus	Trojan.Inject
eGambit	Unsafe.AI_Score_97%
Fortinet	W32/Injector.ENEZ!tr
Webroot	W32.Trojan.Gen
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Generic/HEUR/QVM05.1.6359.Malware.Gen