Categories: Malware

Win32/Agent.NAY removal guide

The Win32/Agent.NAY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent.NAY virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
Reads data out of its own binary image
Manipulates data from or to the Recycle Bin
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
Creates an autorun.inf file
Authenticode signature is invalid
Deletes its original binary from disk
Attempts to modify desktop wallpaper
Exhibits possible ransomware file modification behavior
Harvests cookies for information gathering
Attempts to interact with an Alternate Data Stream (ADS)

How to determine Win32/Agent.NAY?


File Info:
name: 8955AE8C5603BC488FE5.mlwpath: /opt/CAPEv2/storage/binaries/d6590599002f3ba78807ee4565e5dba0afc47975fb9af2eb0f2eacf9f2910908crc32: 38DA229Dmd5: 8955ae8c5603bc488fe5731d93590aa3sha1: a1a860207ba5c423d47b1c4e6d69d2afa3d6d834sha256: d6590599002f3ba78807ee4565e5dba0afc47975fb9af2eb0f2eacf9f2910908sha512: 13b2d4796ad393033fe47699d6f28d661ebecda9b6971b6de2bc862c908798f4096ebf4e0fbc236ded1cff6dc10f0ea3da02b780e71e8bd69a98b4c62f5d00a7ssdeep: 6144:mB72XGbIQqeHdA51d18T+G0QXMW30gPTB5/uw7:mY2baKYE5Tf/btype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A4446D16339009F5E8779275C9A38B15D632BC5A0330D34F0796AB722F33761A93E39Asha3_384: d731a588b906c6658aade660e536d9680cb6b5c1ffe497800d7dede606fc7846e49d33359ef77a9958e837dc92009cb1ep_bytes: e8bbffffffe855ffffff33c0c3909090timestamp: 2009-11-16 04:31:57
Version Info:
0: [No Data]

Win32/Agent.NAY also known as:

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Gen:Variant.Graftor.182065
ALYac	Gen:Variant.Graftor.182065
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0001140e1 )
K7GW	Trojan ( 0001140e1 )
Cybereason	malicious.c5603b
VirIT	Trojan.Win32.Generic.ACYD
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Agent.NAY
APEX	Malicious
Kaspersky	Trojan.Win32.Cosmu.cbth
BitDefender	Gen:Variant.Graftor.182065
NANO-Antivirus	Trojan.Win32.Scar.iecip
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Graftor.182065
Emsisoft	Gen:Variant.Graftor.182065 (B)
DrWeb	Win32.HLLP.Lj.1
Zillya	Trojan.Scar.Win32.12512
FireEye	Generic.mg.8955ae8c5603bc48
Ikarus	Trojan.Win32.Crypt
GData	Gen:Variant.Graftor.182065
Jiangmin	Trojan/Scar.mmi
Avira	TR/Agent.32768.AM
Arcabit	Trojan.Graftor.D2C731
ViRobot	Trojan.Win32.Scar.32768.D
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Cosmu.R75796
MAX	malware (ai score=89)
VBA32	Trojan.Cosmu
Yandex	Trojan.Scar!mtZpCoFoYo8
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.NAY
BitDefenderTheta	AI:Packer.C4D6D90E20
AVG	Win32:Trojan-gen
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_70% (D)