Should I remove “Trojan:Win32/Agent.OD”?

The Trojan:Win32/Agent.OD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Agent.OD virus can do?

• Sample contains Overlay data
• HTTPS urls from behavior.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Operates on local firewall’s policies and settings
• Deletes executed files from disk
• Attempts to disable Windows Auto Updates
• Attempts to modify or disable Security Center warnings
• Modifies Image File Execution Options, indicative of process injection or persistence
• Anomalous binary characteristics

How to determine Trojan:Win32/Agent.OD?

File Info:
name: 8CD40CA13E7DADF7CD29.mlw
path: /opt/CAPEv2/storage/binaries/4cfa38d8e0ebe11b4ce18d7f26f6302d8ce0ab3a1f614a5a492d2cd3536e9431
crc32: C4D5F4DC
md5: 8cd40ca13e7dadf7cd29ac4dcf458de4
sha1: 410dc03e95d786e839bc402d0a7bb9f0f770c242
sha256: 4cfa38d8e0ebe11b4ce18d7f26f6302d8ce0ab3a1f614a5a492d2cd3536e9431
sha512: bfcee74c04c0f33c95134ca673d4f3f08b274798a5266704fc466ffdef1795952304941e5aabc6909881ba0732844b807a8bffc3ed9e96af344a0375f761d391
ssdeep: 1536:hxHvcQWUMDyGG/MZ3kXl4UtORarUDffx3QxB3wsgrenhtKP:vHEbUMDyGG/MZ3kX93cfa/yehtw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T136934B428E2EC903F99313778AE6C5F2FEB8D48DAAE19B3B6148CD27352705C05E5517
sha3_384: 29a1a9bcff956926d1d5f0329281a584376cc97f6dbe617033b4359cfaeefd2383164e0ed31eac77ad43dc0e816fa9b0
ep_bytes: 5557565381eccc050000a1f2134000c7
timestamp: 2006-12-14 12:10:05

Version Info:
0: [No Data]

Trojan:Win32/Agent.OD also known as:

How to remove Trojan:Win32/Agent.OD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.