Should I remove “Trojan.Agent.CSAF (B)”?

The Trojan.Agent.CSAF (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Agent.CSAF (B) virus can do?

Creates RWX memory
Network activity detected but not expressed in API logs

How to determine Trojan.Agent.CSAF (B)?


File Info:
crc32: D20991B1
md5: 7cc15cbc32de6c99ae9373fa638d1c4f
name: 7CC15CBC32DE6C99AE9373FA638D1C4F.mlw
sha1: 46844b5b92d6be7665c1d402c2957a3887b8d2be
sha256: 1db91ca74a723e5f369cbd1e0be14a1d2fffc3292a84c93c1bed1e0103498f92
sha512: b1c974fc4797bd7daeed475563260aa067eb61488e71894aec93fa849ad3d250b581a702e0f72ea6b5c8584c74e38ebaa183b8eba914225c1071140915f4581d
ssdeep: 12288:Vi7dzDmqCULB8vxjNRnrlM6PdY13Z0SvC8Tvj0stWC/PT8R2JJ9GFR4z9wUol:o7nC9JRrlMKYgSvCsWQPgRk9a
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 4754
Assembly Version: 3.3.8.8
InternalName: DemarrageManifest.exe
FileVersion: 0.3.2.1
CompanyName: 3N1WTN
LegalTrademarks: 
Comments: 3N1W
ProductName: 3N1WT
ProductVersion: 0.3.2.1
FileDescription: 3N1WTNML
OriginalFilename: DemarrageManifest.exe

Trojan.Agent.CSAF (B) also known as:

K7AntiVirus	Trojan ( 0055ca211 )
Lionic	Trojan.MSIL.Generic.b!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader25.56034
ALYac	Trojan.Agent.CSAF
Malwarebytes	Adware.Tuto4PC.Generic
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.Agent.CSAF
K7GW	Trojan ( 0055ca211 )
Cybereason	malicious.c32de6
Cyren	W32/MSIL_Kryptik.CRZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.LML
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Dropper.MSIL.Generic
NANO-Antivirus	Trojan.Win32.EoRezo.ewfpqj
MicroWorld-eScan	Trojan.Agent.CSAF
Tencent	Msil.Trojan-dropper.Generic.Alsr
Ad-Aware	Trojan.Agent.CSAF
Sophos	Mal/Kryptik-AQ
Comodo	TrojWare.MSIL.Occamy.L@7oyjk8
BitDefenderTheta	Gen:NN.ZemsilF.34266.Tm0@aSk1L4i
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.bh
FireEye	Generic.mg.7cc15cbc32de6c99
Emsisoft	Trojan.Agent.CSAF (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanDropper.MSIL.pms
Avira	ADWARE/EoRezo.Gen7
Antiy-AVL	Trojan/Generic.ASMalwS.2373A85
Microsoft	Trojan:Win32/Occamy.C
SUPERAntiSpyware	Adware.Tuto4PC/Variant
GData	Trojan.Agent.CSAF
AhnLab-V3	PUP/Win32.BundleInstaller.C1744477
Acronis	suspicious
VBA32	Trojan.Downloader
MAX	malware (ai score=100)
Yandex	Trojan.Kryptik!242RyKuo9fw
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.GBD!tr
Panda	Trj/GdSda.A

How to remove Trojan.Agent.CSAF (B)?

Trojan.Agent.CSAF (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X