Categories: Trojan

TrojanDownloader:Win32/Agent.ZDI removal instruction

The TrojanDownloader:Win32/Agent.ZDI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Agent.ZDI virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities
Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDownloader:Win32/Agent.ZDI?


File Info:
name: 02F2403EB6C52AA121D4.mlwpath: /opt/CAPEv2/storage/binaries/7cfe4ba9259cccbc95b2eed7d7a061bccebb74546d24e07ce06d91401043e47ecrc32: 9F1BFE67md5: 02f2403eb6c52aa121d417961838875dsha1: 46c19302032434aa28775ab419c1096ab9533787sha256: 7cfe4ba9259cccbc95b2eed7d7a061bccebb74546d24e07ce06d91401043e47esha512: 51ba31b88ea7c87cb3d88965dc023a68492ecc9b75cca1fdeb0a958b7ef063835d6ec1d6a1fa120ec8a125e1f61ee868c35b1543c026c20288b5185b9049fbb5ssdeep: 1536:MOQEKDy+AxiuqmEHc6jIUChqHpTl8/RlkKy4R:f0y+AxiuzkzTy/RWtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F553D6239A04511AF24AC6F12C65A5F6792A7E3006C0AD0BF749FF592AB0697B4F431Fsha3_384: db2eca4124f76708bc29f09651a052209dc0e96f66a14f9d2e93f21fdd3398469586d5641e2920274710078c728df500ep_bytes: 68b41e4000e8eeffffff000000000000timestamp: 2008-08-05 12:46:12
Version Info:
0: [No Data]

TrojanDownloader:Win32/Agent.ZDI also known as:

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.AutoRun.l7CB
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Backdoor.39
ClamAV	Win.Malware.Razy-9841581-0
FireEye	Generic.mg.02f2403eb6c52aa1
Skyhigh	BehavesLike.Win32.Generic.kt
McAfee	Artemis!02F2403EB6C5
Cylance	unsafe
Zillya	Trojan.WOW.Win32.11556
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Trojan-Downloader ( 0048cfa31 )
Alibaba	TrojanDownloader:Win32/Generic.4ea53ba4
K7GW	Trojan-Downloader ( 0048cfa31 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.OLG.BRWZ
Symantec	Downloader
ESET-NOD32	a variant of Win32/TrojanDownloader.VB.CEJ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-GameThief.Win32.WOW.syfm
BitDefender	Gen:Variant.Backdoor.39
NANO-Antivirus	Trojan.Win32.WOW.lahj
Avast	Win32:Evo-gen [Trj]
Tencent	Win32.Trojan-GameThief.WOW.Ztjl
Emsisoft	Gen:Variant.Backdoor.39 (B)
F-Secure	Trojan.TR/Patched.Ren.Gen
DrWeb	BackDoor.Generic.1611
VIPRE	Gen:Variant.Backdoor.39
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-R
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.13LF282
Jiangmin	Trojan/PSW.WOW.gcj
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Patched.Ren.Gen
Antiy-AVL	Trojan[GameThief]/Win32.WOW
Kingsoft	Win32.Troj.Unknown.a
Xcitium	TrojWare.Win32.PSW.WOW.~aq@faxo6
Arcabit	Trojan.Backdoor.39
ViRobot	Trojan.Win32.A.PSW-Wow.65536.P
ZoneAlarm	Trojan-GameThief.Win32.WOW.syfm
Microsoft	TrojanDownloader:Win32/Agent.ZDI
Varist	W32/VBTrojan.17D2!Maximus
AhnLab-V3	Backdoor/Win32.DsBot.R11585
BitDefenderTheta	Gen:NN.ZevbaF.36744.eiW@aiooLkc
ALYac	Spyware.WOW
MAX	malware (ai score=100)
VBA32	TScope.Trojan.VB
Malwarebytes	Generic.Malware.AI.DDS
Panda	Generic Malware
Rising	Trojan.Win32.VB.fwa (CLASSIC)
Ikarus	Trojan-PSW.OnlineGames
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/VB.CEJ!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.203243
DeepInstinct	MALICIOUS