Trojan.Agent.ERLI removal tips

The Trojan.Agent.ERLI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.ERLI virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Creates a hidden or system file
Creates a copy of itself
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

mecharnise.ir

How to determine Trojan.Agent.ERLI?


File Info:
crc32: A3E13D54
md5: 5dae5856d2dd5b779a9aedb83e976f50
name: schiefx.exe
sha1: df237daa53e30baca02357e68837b1bf58865977
sha256: f82f56f60ec14ec13f4668b5f7e30167760287da0c8215e08979609934ad52ba
sha512: ed81aa61d93c42235be078af252a77b94790025ec1ec39af1d2805d9c852acc48921df71243fe27f06de3ada0f4b26b745e9a0e586b1f3249dd8b23cc9ad5ea2
ssdeep: 12288:MC1TxYROXXH+NrZEb3StxjYr5Cm96D6W9hkwHXlGRY9Hv:ltPHeO3q21Cyc6qB3lUYF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan.Agent.ERLI also known as:

MicroWorld-eScan	Trojan.Agent.ERLI
FireEye	Generic.mg.5dae5856d2dd5b77
McAfee	Fareit-FTB!5DAE5856D2DD
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Kryptik.4!c
K7AntiVirus	Trojan ( 0056739d1 )
BitDefender	Trojan.Agent.ERLI
K7GW	Trojan ( 0056739d1 )
Cybereason	malicious.a53e30
TrendMicro	Trojan.Win32.WACATAC.THEBFBO
BitDefenderTheta	Gen:NN.ZelphiF.34122.LGW@aO4P0nhi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EMBN
TrendMicro-HouseCall	Trojan.Win32.WACATAC.THEBFBO
Avast	Win32:RATX-gen [Trj]
ClamAV	Win.Trojan.Generic-7899121-0
GData	Trojan.Agent.ERLI
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
Alibaba	Trojan:Win32/DelfInject.ali2000015
Tencent	Win32.Backdoor.Fareit.Auto
Ad-Aware	Trojan.Agent.ERLI
F-Secure	Trojan.TR/Injector.wewaf
DrWeb	Trojan.PWS.Siggen2.49330
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jh
SentinelOne	DFI – Suspicious PE
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.Agent.ERLI (B)
APEX	Malicious
Avira	TR/Injector.wewaf
Antiy-AVL	Trojan/Win32.Wacatac
Endgame	malicious (high confidence)
Arcabit	Trojan.Agent.ERLI
AhnLab-V3	Suspicious/Win.Delphiless.X2066
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
Microsoft	Trojan:Win32/NanoCore.VD!MTB
Acronis	suspicious
VBA32	TScope.Trojan.Delf
ALYac	Spyware.LokiBot
MAX	malware (ai score=87)
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/GdSda.A
Rising	Trojan.Injector!8.C4 (CLOUD)
Ikarus	Trojan.Win32.Injector
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.ELXR!tr
AVG	Win32:RATX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.469

How to remove Trojan.Agent.ERLI?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Agent.ERLI removal tips