Trojan.Agent.FGKS (B) removal guide

The Trojan.Agent.FGKS (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.FGKS (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan.Agent.FGKS (B)?

File Info:
name: 6BB60101E3E13BD02FF5.mlw
path: /opt/CAPEv2/storage/binaries/c5eb4c43e961b8082d48d081efcec8d6f8d8027d8c8311d493104fe0d663dad2
crc32: 71CBE708
md5: 6bb60101e3e13bd02ff5ec2f6a2107d7
sha1: c2ca3a3e3996b2580d5010d9b6b1291b65e5b4ed
sha256: c5eb4c43e961b8082d48d081efcec8d6f8d8027d8c8311d493104fe0d663dad2
sha512: a57407ccb7025e33fe73e5c79524f36526ade11bcc6ef3f68fd66841526fe28d93b16163e00f860216934cdddc1aeef07053e0116245970b59e5f604a3855dfd
ssdeep: 3072:dLeYuefaK9P2FjBXeokd0sYpIlbWf0tx3BdxGoQFejgpZLetdCnaskl4w:NeYul0uzLUYzqxbfc6o1nLy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T105E3F1F6A3B60950C02BDC3B71979BBCFBB9842BD6F682C904634E0589EC5911DE4673
sha3_384: 868d53f84c10bf3c2a543c282bdcfaad629bb1e25507f780ad62102cfe36423de485c5db23e89a6e0f0b8e3714ef1457
ep_bytes: 60be15f070008dbeeb1fcfff57eb0b90
timestamp: 2007-02-19 09:07:54

Version Info:
CompanyName: Odbmbhnv Fliyqw
FileDescription: Odbmbhnv Tpdywvvckv Rlfqm
FileVersion: 16, 91, 63, 27
InternalName: Odbmbhnv
LegalCopyright: Copyright © Odbmbhnv Fliyqw 1999-2005
OriginalFilename: Odbmbhnv.exe
ProductName: Odbmbhnv Tpdywvvckv Rlfqm
ProductVersion: 41, 20, 80, 13
Translation: 0x0409 0x04e4

Trojan.Agent.FGKS (B) also known as:

How to remove Trojan.Agent.FGKS (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.