Trojan.Agent.EMGS removal guide

The Trojan.Agent.EMGS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.EMGS virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Agent.EMGS?


File Info:
crc32: A25F16BD
md5: 02fd08593bf86cb8e9d3e6876b7169b0
name: twcdwjr.bin
sha1: d56c823b97089f7ff6bbf6162185e1ea20befd5b
sha256: 703d1d01d70fdab48aace14d232ea1d673ecbc765adbd62a41c108e158325c95
sha512: c90208335469be3b935d2e00bd0fcaa48cad5fb2e8bc0c191d4dbf71c4ae40c3b543a0b1f4a2519a6797d470ba8caaa084e469aac612cb1c52cbb5be4e566f55
ssdeep: 3072:tqtuSsEiVpeilR2GSdEbEdvBNbdtuLCrM7DVP7MjWaDAoV+j7QBI2z0n2rQ3IG:/SshxbS+2DbGLCslMKaDAogmQcW
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (c) 1990-2018 Citrix Systems, Inc.
InternalName: VDIME
FileVersion: 14.12.0.18020
CompanyName: Cytrix Systems, Inc.
ProductName: Citrix Receiver
ProductVersion: 14.12.0
FileDescription: Cytrix Receiver VDIME Resource DLL (Win32)
OriginalFilename: VDIME.DLL
Translation: 0x0409 0x04b0

Trojan.Agent.EMGS also known as:

Bkav	HW32.Packed.
DrWeb	Trojan.Dridex.648
MicroWorld-eScan	Trojan.GenericKD.42678435
McAfee	RDN/Generic.hra
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0055f9001 )
BitDefender	Trojan.GenericKD.42678435
K7GW	Trojan ( 0055f9001 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D28B38A3
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34090.mC0@aGXzU1qj
Cyren	W32/Trojan.FRDO-6636
ESET-NOD32	Win32/Dridex.CW
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	Trojan-Downloader.Win32.Cridex.cqo
Alibaba	TrojanDownloader:Win32/Cridex.20da8226
NANO-Antivirus	Virus.Win32.Gen.ccmw
Rising	Trojan.Generic@ML.98 (RDMK:rroJ4PISKogeo8z5L7RK1Q)
Endgame	malicious (high confidence)
Comodo	Malware@#37nnl702l72p6
TrendMicro	TrojanSpy.Win32.EMOTET.THBBFBO
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.02fd08593bf86cb8
Sophos	Mal/Generic-S
Ikarus	Trojan.Agent
Fortinet	W32/Dridex.CW!tr
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/Emotet.LK!ml
ZoneAlarm	Trojan-Downloader.Win32.Cridex.cqo
Acronis	suspicious
ALYac	Trojan.Agent.EMGS
MAX	malware (ai score=89)
Ad-Aware	Trojan.GenericKD.42678435
Panda	Trj/CI.A
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THBBFBO
Tencent	Win32.Trojan-downloader.Cridex.Glx
SentinelOne	DFI – Malicious PE
GData	Trojan.GenericKD.42678435
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.93bf86
Paloalto	generic.ml
Qihoo-360	Generic/HEUR/QVM20.1.7C0D.Malware.Gen

How to remove Trojan.Agent.EMGS?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Agent.EMGS removal guide