Should I remove “Trojan.Agent.SZ”?

The Trojan.Agent.SZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.SZ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• HTTPS urls from behavior.
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to modify proxy settings
• Operates on local firewall’s policies and settings
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Creates a copy of itself
• Attempts to disable UAC
• Attempts to modify or disable Security Center warnings
• Attempts to block SafeBoot use by removing registry keys
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Trojan.Agent.SZ?

File Info:
name: 829D78E731593572B439.mlw
path: /opt/CAPEv2/storage/binaries/b3d0526a24911a575803c6c4e8fba342810dd64aae2c057d43bb01e853dbbb4b
crc32: EEDB13AF
md5: 829d78e731593572b439646022c2c04a
sha1: 7b8702a93c83daa1b15ffb33df7bd337cec0a964
sha256: b3d0526a24911a575803c6c4e8fba342810dd64aae2c057d43bb01e853dbbb4b
sha512: b6456dea3c305e7ba0c20cac08aca8c444877431bd6065043c5a93d12cfd125e29601dfdf883b6800a0df4155377bfc27fc49be0d7f46c1d40624eaf71d3196c
ssdeep: 3072:TbHkjX12X6wvHk3McN//cjU7JWPHa225xUtBniZ0Tmve8P2fXdkafc6XIcab:kjX1fMcIA4PIxUTtmvu6aQc2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12914F145B3A022C0C979C5775AE3FD63B21BA59C1721CD83D20C6FFAEAC1559C74B8A2
sha3_384: 1253f59e47201a2d586fd77b0fbf5319349a61886e806a5cb55a5e57cb5b9f05ac561014f9421f7b3990c539ed9273e7
ep_bytes: 60bfd89008efb54f4169db8575889b8a
timestamp: 2011-03-07 01:11:36

Version Info:
FileVersion: 3, 7, 6
FileDescription: Vyzovyz Kuvy Obimag
CompanyName: Cyberlink, Corp.
InternalName: Ykes
OriginalFilename: Qj5fgi4rs.exe
LegalTrademarks: Esax Urovys Aqazigy Edefub Yza
ProductVersion: 3, 7
ProductName: Yniqaka
Translation: 0x0409 0x04b0

Trojan.Agent.SZ also known as:

How to remove Trojan.Agent.SZ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.