Categories: Malware

Win32/Agent.NAG removal

The Win32/Agent.NAG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent.NAG virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Agent.NAG?


File Info:
name: 7B03EAC2D2104AE01A32.mlwpath: /opt/CAPEv2/storage/binaries/4226d01d07e1b49255f265a3418820030334e32de913a25b2523f54e7135b24acrc32: AD4CDDA3md5: 7b03eac2d2104ae01a32c27db47fe578sha1: b7c26b29752aec58fc4b30f46ad32418e1ce76c0sha256: 4226d01d07e1b49255f265a3418820030334e32de913a25b2523f54e7135b24asha512: 0b7a5c52d17e48be9301c0ebf8aa3daca79218557a5ada9ecff8b03060b0db832212a02d56dd2667f64c75d5956a79794ade9dd83303eb235e3f9d9be638bb60ssdeep: 3072:2aqwmOGqM8OROAO5UTS7vGcoWxg7YjcZJQgKFZhYZ4z1sxtbjIUWnoRzn8:2aq0M8OQAO5WS6cVxgGcC+Z4zytbLgtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T171344A01B2C18072E1E2227565B66736AF3A7D711B31DA8BD790DE6A2C706E0ED343D7sha3_384: 2cbcdb478f331488e086dad5da5b8ae9a505a95d27ed1c391ce0ec066c0f90628c65cb5a5b4c57c70ec89f4136174369ep_bytes: 60e8000000005b81ebd048001083ec74timestamp: 1998-06-17 17:12:36
Version Info:
CompanyName: Microsoft CorporationFileDescription: Programme d'amorçage d'installation pour le jeu d'outils d'installation de Visual BasicFileVersion: 6.00.8168InternalName: SETUP.EXELegalCopyright: Copyright © 1987-1998 Microsoft Corp.LegalTrademarks: Microsoft® est une marque déposée de Microsoft Corporation. Windows(TM) est une marque de Microsoft Corporation.OriginalFilename: SETUP.EXEProductName: Microsoft® Visual Basic pour WindowsProductVersion: 6.00.8168Comments: 14 avril 1998Translation: 0x040c 0x04e4

Win32/Agent.NAG also known as:

Bkav	W32.OlayFara.PE
Lionic	Virus.Win32.Slugin.kZkk
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.SlugIn.A
FireEye	Generic.mg.7b03eac2d2104ae0
CAT-QuickHeal	W32.Slugin.A
Skyhigh	W32/Wplugin
ALYac	Win32.SlugIn.A
Cylance	unsafe
Zillya	Virus.Slugin.Win32.1
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Virus:Win32/Slugin.2352c0d5
K7GW	Trojan ( 000ff64e1 )
K7AntiVirus	Trojan ( 000ff64e1 )
Arcabit	Win32.SlugIn.A
BitDefenderTheta	AI:FileInfector.FAF1C2C00E
VirIT	Win32.Slugin.A
Symantec	W32.Slugin.A!inf
ESET-NOD32	Win32/Agent.NAG
Cynet	Malicious (score: 99)
ClamAV	Win.Worm.Arem-9881524-0
Kaspersky	Virus.Win32.Slugin.a
BitDefender	Win32.SlugIn.A
NANO-Antivirus	Virus.Win32.Slugin.ddowbn
Avast	Win32:Patched-HO [Trj]
Tencent	Virus.Win32.Wplugin.a
Sophos	W32/Slugin-A
Baidu	Win32.Virus.Slugin.a
F-Secure	Trojan.TR/Agent.mkz
DrWeb	Win32.Wplugin.1
VIPRE	Win32.SlugIn.A
TrendMicro	PE_WPLUG.A
Emsisoft	Win32.SlugIn.A (B)
Ikarus	Trojan.Win32.Patched
Jiangmin	Win32/PatchFile.bi
Varist	W32/Slugin.B
Avira	TR/Agent.mkz
Antiy-AVL	Virus/Win32.Slugin.a
Kingsoft	Win32.Patched.dj.161283
Xcitium	TrojWare.Win32.Patched.P@x8nxi
Microsoft	Virus:Win32/Slugin.A
ViRobot	Win32.Patched.N
ZoneAlarm	Virus.Win32.Slugin.a
GData	Win32.Virus.Slugin.A
Google	Detected
AhnLab-V3	Win32/Slugin
McAfee	W32/Wplugin
MAX	malware (ai score=83)
VBA32	Trojan.Patched.dj
Malwarebytes	Generic.Malware.AI.DDS
Panda	Generic Malware
Zoner	Virus.Win32.90
TrendMicro-HouseCall	PE_WPLUG.A
Rising	Virus.Agent!1.9AF8 (CLASSIC)
Yandex	Win32.Slugin.A
SentinelOne	Static AI – Malicious PE
MaxSecure	Virus.W32.Slugin.A
Fortinet	W32/Wplug.A
AVG	Win32:Patched-HO [Trj]
DeepInstinct	MALICIOUS