How to remove “Trojan.Win32.Agent.qwerff”?

The Trojan.Win32.Agent.qwerff is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Agent.qwerff virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Korean
Authenticode signature is invalid

How to determine Trojan.Win32.Agent.qwerff?


File Info:
name: AAFB66617C61740E4675.mlw
path: /opt/CAPEv2/storage/binaries/7714c721d94bb8378c965a8b505a547f8176a294ee997c696996be5746629be0
crc32: 2C46DFE7
md5: aafb66617c61740e4675359e3d05cd57
sha1: f54b3f2e3d32de6689c4a4254971dfec84e0db62
sha256: 7714c721d94bb8378c965a8b505a547f8176a294ee997c696996be5746629be0
sha512: fedb1d523e766d10f129f3925c9bdc82e83abecb033992b44ce1e5cd70b822e548c269feb20bd12097aa5e7d4c2e959d6bad1ab3809dbd1d2b9d7cfd2891e5c6
ssdeep: 1536:1S8sX6RmE7QEZZRm3EVQ/GMqOboENswaSRJjScltGXD/B:c7KtjZRyOqsrSbjRGTp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12FC3182386A8D65FF6528AB20C36EA6D253C3D3B0145AD0B7081FD489D76E43E87573B
sha3_384: d10bff356dc2544396866fe95b84d0e81517cf358923cf73f1bc0afc8a9d3f9227d76a1735322a607d48994fccb39451
ep_bytes: 6868324000e8f0ffffff000048000000
timestamp: 2017-10-13 10:22:18

Version Info:
Translation: 0x0412 0x04b0
CompanyName: Park
ProductName: UTIS
FileVersion: 1.00
ProductVersion: 1.00
InternalName: UTIS 실행
OriginalFilename: UTIS 실행.exe

Trojan.Win32.Agent.qwerff also known as:

Lionic	Trojan.Win32.Agent.4!c
McAfee	Artemis!AAFB66617C61
Cylance	Unsafe
Alibaba	Trojan:Win32/Generic.92214edb
APEX	Malicious
Kaspersky	Trojan.Win32.Agent.qwerff
NANO-Antivirus	Trojan.Win32.Mlw.euxjit
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Agent.Lqyt
Comodo	Malware@#df93dygka7iy
F-Secure	Trojan.TR/Agent.npwjr
McAfee-GW-Edition	BehavesLike.Win32.Swisyn.cm
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Ikarus	HackTool.Win32.VB
Jiangmin	Trojan.Agent.bgak
Avira	TR/Agent.npwjr
Microsoft	Trojan:Win32/Occamy.AA
ZoneAlarm	Trojan.Win32.Agent.qwerff
VBA32	Trojan.Agent
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.Agent!8.B1E (CLOUD)
Yandex	Trojan.Agent!fWkm4iUOgp4
MaxSecure	Trojan.Malware.102827551.susgen
Fortinet	W32/Agent.QWERFF!tr
AVG	Win32:Malware-gen
Cybereason	malicious.17c617
Panda	Trj/GdSda.A

How to remove Trojan.Win32.Agent.qwerff?

Trojan.Win32.Agent.qwerff removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X