Categories: Trojan

VBA/TrojanDownloader.Agent.UFY removal

The VBA/TrojanDownloader.Agent.UFY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What VBA/TrojanDownloader.Agent.UFY virus can do?

  • The office file contains 2 macros
  • The office file contains a macro with auto execution
  • The office file contains anomalous features
  • The office file contains a macro with suspicious strings

Related domains:

z.whorecord.xyz

How to determine VBA/TrojanDownloader.Agent.UFY?


File Info:

crc32: 7FD7C47Bmd5: a79efaf83bb12d502c1a391dbbf27065name: upload_filesha1: cffb85341e765e7575dc41f5f2f6231625121527sha256: fe6df9e2fcfce73089b965934808ae4997a27be93a4f7deea34ca99e0f8b2a1asha512: e701468291159e873df0b5f27721e6894043c44cb6c5c68ac81c870592541c38b1d3ef8eab60e9b9aea38176e99a2489e3ea05980f2f6178f52541ce0e4abbffssdeep: 3072:o4PrXcuQuvpzm4bkiaMQgAlSwUmFazEnmhjswJ6:FDRv1m4bnQgISw7vmJswJ6type: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Cumque., Author: Benjamin Le roux, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Aug 19 18:17:00 2020, Last Saved Time/Date: Wed Aug 19 18:17:00 2020, Number of Pages: 2, Number of Words: 5, Number of Characters: 30, Security: 0

Version Info:

0: [No Data]

VBA/TrojanDownloader.Agent.UFY also known as:

Elastic malicious (high confidence)
MicroWorld-eScan W97m.Downloader.IXT
FireEye W97m.Downloader.IXT
CAT-QuickHeal OLE.Emotet.38786
ALYac W97m.Downloader.IXT
VIPRE Trojan-Downloader.W97M.Agent.jc (v)
AegisLab Trojan.MSOffice.SAgent.4!c
Invincea Troj/DocDl-AAGM
Cyren W97M/Downldr.IE.gen!Eldorado
Symantec W97M.Downloader
TrendMicro-HouseCall Trojan.W97M.POWLOAD.THHBOBO
ClamAV Doc.Malware.Sagent-9401419-0
Kaspersky HEUR:Trojan.MSOffice.SAgent.gen
BitDefender W97m.Downloader.IXT
NANO-Antivirus Trojan.Script.Downloader.htfcpy
Rising Trojan.Downloader!1.CAAF (CLASSIC)
Ad-Aware W97m.Downloader.IXT
F-Secure Malware.W97M/Agent.3758011
DrWeb Exploit.Siggen2.24702
TrendMicro Trojan.W97M.POWLOAD.THHBOBO
Sophos Troj/DocDl-AAGM
Ikarus Trojan-Downloader.VBA.Emotet
Avira W97M/Agent.3758011
MAX malware (ai score=100)
Antiy-AVL Trojan[Downloader]/MSOffice.Agent.ucn
Microsoft TrojanDownloader:O97M/Emotet.CSK!MTB
Arcabit W97m.Downloader.IXT
ZoneAlarm HEUR:Trojan.MSOffice.SAgent.gen
GData W97m.Downloader.IXT
Cynet Malicious (score: 85)
AhnLab-V3 Downloader/DOC.Emotet.S1279
McAfee W97M/Downloader.ddv
VBA32 TrojanDownloader.O97M.Emotet.CSK
Zoner Probably Heur.W97Obfuscated
ESET-NOD32 VBA/TrojanDownloader.Agent.UFY
Tencent Heur.Macro.Generic.j.62bd02b
Fortinet VBA/Agent.K!tr.dldr
AVG SNH:Script [Dropper]
Panda W97M/Downloader.DDE
Qihoo-360 virus.office.qexvmc.1065

How to remove VBA/TrojanDownloader.Agent.UFY?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

How to remove “Trojan:Win32/AutoitInject.RE!MTB”?

The Trojan:Win32/AutoitInject.RE!MTB is considered dangerous by lots of security experts. When this infection is active,…

11 mins ago

Worm.VobfusVMF.S19740081 information

The Worm.VobfusVMF.S19740081 is considered dangerous by lots of security experts. When this infection is active,…

16 mins ago

Malware.AI.986323659 removal guide

The Malware.AI.986323659 is considered dangerous by lots of security experts. When this infection is active,…

28 mins ago

Generic.Dacic.1636.DB5B5110 removal

The Generic.Dacic.1636.DB5B5110 is considered dangerous by lots of security experts. When this infection is active,…

32 mins ago

Application.Application.Graftor.406603 (B) (file analysis)

The Application.Application.Graftor.406603 (B) is considered dangerous by lots of security experts. When this infection is…

42 mins ago

Generic.Dacic.1A7FA519.A.F5972732 removal instruction

The Generic.Dacic.1A7FA519.A.F5972732 is considered dangerous by lots of security experts. When this infection is active,…

52 mins ago