Categories: Malware

VBS/Agent.NPV information

The VBS/Agent.NPV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VBS/Agent.NPV virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Appears to use command line obfuscation

How to determine VBS/Agent.NPV?


File Info:
name: EEF99F3F77C52299994B.mlwpath: /opt/CAPEv2/storage/binaries/f7a479a546a72328c1456342b0421499f77cde45adf39a419101ee02542e37b4crc32: 4F5D922Amd5: eef99f3f77c52299994bdaa618b78573sha1: 92c5fecd6692be8e1161e4d7e17d82ffb55847f7sha256: f7a479a546a72328c1456342b0421499f77cde45adf39a419101ee02542e37b4sha512: d7c1089a37c7277e31765f14712010e83f2288a193f93a49fa61fd3c2c47039f2540b35c07896c5b2b9d53387f155127abc979c2d7fc9eb9a3d096db69f1179assdeep: 3072:N1jaUW1yuwpk7U8P1AAAAA+X1sMsZFUuwXXnbgGmqYQmZK:N1jwMuKYU8rsXjynlbYNKtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F2E3AD017FEB40F6D2E22A3058457BA24AFAFF250B558ACB57903A0B1D716C2D77D2C6sha3_384: f6139cab0f1c80804adb1347d8df8ecd847146e9e8da137856dd25cab4117e7676773309767b42a202b21bed60d3d449ep_bytes: 558bec6aff6878c84100684095410064timestamp: 2016-04-02 22:14:00
Version Info:
CompanyName: GoogleLegalCopyright: Google inkLegalTrademarks: GoogleOriginalFilename: updateFileVersion: 2.7.64ProductName: Google UpdaterProductVersion: 2.7InternalName: updateFileDescription: Google UpdaterCreated: 7z SFX Constructor v3.2.0.0 (http://usbtor.ru/viewtopic.php?t=798)Builder: Алексей 12:01:33 18/08/2017Translation: 0x0000 0x04b0

VBS/Agent.NPV also known as:

Cynet	Malicious (score: 99)
FireEye	Generic.mg.eef99f3f77c52299
McAfee	RDN/Generic.dx
Cylance	Unsafe
Sangfor	Trojan.Win32.VbsStartup.ah
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	VBS/Agent.NPV
Avast	Win32:Adware-gen [Adw]
Kaspersky	Trojan.Win32.VbsStartup.ah
BitDefender	Trojan.GenericKD.48287553
MicroWorld-eScan	Trojan.GenericKD.48287553
Ad-Aware	Trojan.GenericKD.48287553
DrWeb	Adware.StartPage.52
Emsisoft	Trojan.GenericKD.48287553 (B)
Paloalto	generic.ml
Avira	TR/VB.Agent.heshz
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Trojan.Agent.TFCSD5
MAX	malware (ai score=87)
TrendMicro-HouseCall	TROJ_GEN.R002H0CB722
Rising	Trojan.Agent!8.B1E (TOPIS:E0:BoriFP8OaqT)
Ikarus	Trojan.VBS.Agent
Fortinet	VBS/Agent.NPR!tr
AVG	Win32:Adware-gen [Adw]
CrowdStrike	win/malicious_confidence_60% (W)