Trojan

Trojan.Agent.CQSS removal instruction

Malware Removal

The Trojan.Agent.CQSS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Agent.CQSS virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process created a hidden window
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Exhibits behavior characteristic of Nymaim malware
  • Zeus P2P (Banking Trojan)
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

ocdlaotspa.pw
esgccgm.net
ouespmkmszt.pw
pdsjeumxy.net
pcidhvoucmwq.in
meqghoeuo.pw
ynhjgsrmhsoe.net
ncsind.pw
xbdbdn.in
tlskk.in
wqgch.pw
bwjqclionpk.net
uiayqbirkx.net
yeyfs.net
cslkmk.com
ldsqzfiraqx.in
nhpttaxi.pw
hzwpenhmci.net
garmtp.net
spgzfotugse.net
bcpfht.in
ypzouhjmzr.in
kzkgbvmar.com
nfrbacgwlcnj.pw
enjqj.pw
yhvzrzckkll.in
vixzxxbuv.com
eehnwixjkom.com
fajwyacwooml.net
ihtnuvcfcd.net
ttccplptj.pw
jpbodceznnpf.net
swwbsrcazqu.com
huzwkslo.in
athgdftqlvcw.com
irbozsndl.net
aoamajiwqs.pw
pozidqkm.net
bbbiaqmqg.in
jltwjma.net
dqiea.net
ntgdp.com
prrfhyhriac.net
lncaydhz.in
fgutgnk.com

How to determine Trojan.Agent.CQSS?


File Info:

crc32: 045595F0
md5: bd2e9133c8f0a5752aacea6152c846a3
name: BD2E9133C8F0A5752AACEA6152C846A3.mlw
sha1: 6fb69996339d3f1cf3f2c9ffc5e8504b14dd0031
sha256: dcba66bccc574059b4000dea3b190032ca038748474a74b7293a357e55501bb7
sha512: a4fd3ef7934659e8865ac3ff21292f1467d4a1ca3f4bfb652dc551772f42d4821e24e97ea7175ce6754cf5b078d5520dcfc0d3c9214abd2a548420cb5c905d96
ssdeep: 12288:M2Xq3sHTNAx53O+c/XEHswN5MWCzV/LTDL4zsZd:M2XTHTk5e+3HxjMWaLHU4Zd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan.Agent.CQSS also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Agent.CQSS
FireEyeGeneric.mg.bd2e9133c8f0a575
CAT-QuickHealRansom.Cerber.ZZ4
ALYacTrojan.Agent.CQSS
MalwarebytesTrojan.Nymaim
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Multi.Generic.4!c
K7AntiVirusTrojan ( 0051b2281 )
BitDefenderTrojan.Agent.CQSS
K7GWTrojan ( 0051b2281 )
Cybereasonmalicious.3c8f0a
BitDefenderThetaGen:NN.ZexaF.34804.MuW@a8Xfv1l
CyrenW32/Nymaim.CI.gen!Eldorado
SymantecPacked.Generic.493
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Trojan-Banker.Win32.GozNym.pef
NANO-AntivirusTrojan.Win32.Kryptik.evcpgb
TencentMalware.Win32.Gencirc.10b36acb
Ad-AwareTrojan.Agent.CQSS
TACHYONTrojan/W32.Agent.626688.OM
SophosMal/Generic-S + Mal/Elenoocka-E
ComodoTrojWare.Win32.Crypt.C@7vajd0
F-SecureHeuristic.HEUR/AGEN.1111254
DrWebTrojan.Inject2.63261
ZillyaTrojan.Kryptik.Win32.1305203
McAfee-GW-EditionBehavesLike.Win32.Dropper.jc
EmsisoftTrojan.Agent.CQSS (B)
IkarusTrojan.Win32.Crypt
JiangminTrojan.Refinka.ahs
AviraHEUR/AGEN.1111254
Antiy-AVLTrojan/Win32.TSGeneric
MicrosoftTrojanDownloader:Win32/Nymaim.K
ArcabitTrojan.Agent.CQSS
ZoneAlarmHEUR:Trojan-Banker.Win32.GozNym.pef
GDataTrojan.Agent.CQSS
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Nymaim.R213858
Acronissuspicious
McAfeeTrojan-FOIZ!BD2E9133C8F0
MAXmalware (ai score=99)
VBA32Trojan.Refinka
CylanceUnsafe
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.GCCF
RisingTrojan.Kryptik!1.AE8F (CLASSIC)
YandexTrojan.GenAsa!kWyrPVP1imY
SentinelOneStatic AI – Malicious PE – Downloader
eGambitUnsafe.AI_Score_88%
FortinetW32/Kryptik.GKMB!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360HEUR/QVM19.1.A4A7.Malware.Gen

How to remove Trojan.Agent.CQSS?

Trojan.Agent.CQSS removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment