Should I remove “Trojan.Agent.FSWZ”?

The Trojan.Agent.FSWZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.FSWZ virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Finnish
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Detects Sandboxie through the presence of a library
• Detects Avast Antivirus through the presence of a library
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Checks the presence of disk drives in the registry, possibly for anti-virtualization

How to determine Trojan.Agent.FSWZ?

File Info:
name: 8974B63D6777EAFA884B.mlw
path: /opt/CAPEv2/storage/binaries/f6c5bdddb67c220b569864574d0749e28c06d138384b3a3fa85219aa12e10218
crc32: A122ABE3
md5: 8974b63d6777eafa884b770499c028dc
sha1: abfcb21549e0aa8136375f09f983d2ed140fe287
sha256: f6c5bdddb67c220b569864574d0749e28c06d138384b3a3fa85219aa12e10218
sha512: 244d560a9f9ffe02fdd11e0e50dd8ab12476b0c55c8458dca36b0a18cc738273286fa7227de67025be52cc83d7acd89658bd55f31d7d831228ca5f23b0b16453
ssdeep: 3072:rr6Jz4kHlUXJpLIF7/e4wf57MfgyInhdU6/tsxkgaBCh/k7GStDVA:rmh1HC7LE7G9M4VhdUligaQk7GSVVA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18844BD1276A0C432C4B25D709425EBE1197BBCB34A60D54BFB64BBAE2EB03D15B36347
sha3_384: 0ead2879516ea12b776c1b6926b83813021502e9731341c21a456bc0e589b21556eee8732c8dac78a8599a4cc9538775
ep_bytes: e8c25d0000e979feffff8bff51c70158
timestamp: 2021-08-08 07:53:27

Version Info:
FileVersion: 21.79.11.69
InternationalName: pomgveoci.iwe
Copyright: Copyrighz (C) 2021, fudkorta
ProjectVersion: 1.10.70.57
Translations: 0x0127 0x010e

Trojan.Agent.FSWZ also known as:

How to remove Trojan.Agent.FSWZ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.