Troj/Steal-CAF removal tips

The Troj/Steal-CAF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Steal-CAF virus can do?

Presents an Authenticode digital signature
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Troj/Steal-CAF?


File Info:
crc32: B7E5A2C0
md5: 2af952280c0ec3723136cfdf195a0e4f
name: 2AF952280C0EC3723136CFDF195A0E4F.mlw
sha1: 215ef3b73bc9221a84959681895f2dac9e18dad8
sha256: f657473052da6d9435ef7604646a7d027b1252ae6860a4a3bab7e791c5e41913
sha512: ae9becd575721846649a7323c35938ccf13489e338413113e26d8336b6da6eaa2d26f911ff18d8a47addd43381b187423d4dbc66b4d3a010290d8840f650ef9d
ssdeep: 12288:IkuoqUvAlwjMOIyyQnQyzbJirbbk5vuF1y:LuoaAIlQQyzd4+vu3y
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
Assembly Version: 5.8.0.6930
InternalName: NuGet.Versioning.dll
FileVersion: 5.8.0.6930
CompanyName: Microsoft Corporation
Comments: NuGet's implementation of Semantic Versioning.
ProductName: NuGet
ProductVersion: 5.8.0-rc.6930+830c8be45dbbccd411ecf6080abff0c2c98079cf.830c8be45dbbccd411ecf6080abff0c2c98079cf
FileDescription: NuGet.Versioning
OriginalFilename: NuGet.Versioning.dll

Troj/Steal-CAF also known as:

Lionic	Trojan.MSIL.Agentb.4!c
DrWeb	BackDoor.Remcos.336
ALYac	Trojan.GenericKD.37480949
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Trojan:MSIL/Agentb.19aed637
K7GW	Trojan ( 005818e31 )
K7AntiVirus	Trojan ( 005818e31 )
Cyren	W32/MSIL_Troj.BLY.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.ACRI
Avast	Win32:DangerousSig [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.MSIL.Agentb.gen
BitDefender	Trojan.GenericKD.37480949
MicroWorld-eScan	Trojan.GenericKD.37480949
Tencent	Malware.Win32.Gencirc.11cba750
Ad-Aware	Trojan.GenericKD.37480949
Sophos	Troj/Steal-CAF
TrendMicro	TROJ_FRS.0NA103IE21
FireEye	Generic.mg.2af952280c0ec372
Emsisoft	MalCert-S.LO (A)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.MSIL.agpcz
Avira	TR/Kryptik.qakxj
Antiy-AVL	Trojan/Generic.ASMalwS.3488D25
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Woreflint.A!cl
Gridinsoft	Trojan.Win32.Agent.oa!s1
Arcabit	Trojan.Generic.D23BE9F5
GData	Trojan.GenericKD.37480949
AhnLab-V3	Trojan/Win.Generic.C4622013
McAfee	RDN/Generic.grp
MAX	malware (ai score=85)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.Crypt
Panda	Trj/CI.A
Yandex	Trojan.Agentb!8hijKERRdvo
Ikarus	Trojan.Win32.Generic
MaxSecure	Trojan.Malware.73701643.susgen
Fortinet	MSIL/GenCBL.ATD!tr
AVG	Win32:DangerousSig [Trj]

How to remove Troj/Steal-CAF?

Troj/Steal-CAF removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X