Should I remove “Win32/Agent.NTI”?

The Win32/Agent.NTI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Agent.NTI virus can do?

Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32/Agent.NTI?


File Info:
name: 179FFA5785EAB24A7A96.mlw
path: /opt/CAPEv2/storage/binaries/c156d3f0700d57ed2abd9b18d6df990aab534e8c5d3ee74860757ea37bbb0cb6
crc32: C475A015
md5: 179ffa5785eab24a7a9662440c09bb9f
sha1: c7525316686b5ded7e5971cecc25467e60143103
sha256: c156d3f0700d57ed2abd9b18d6df990aab534e8c5d3ee74860757ea37bbb0cb6
sha512: 0a9aad5c01f42b2d88a7ddbb9e7a60610db582e7cbcb9c1fe27135749f9d6cd75e0b4ac381d5618b6948cdf01f54334839dff15928cd2505003d5e5c8d60c445
ssdeep: 24576:LJU4GnMCOEcRgvRV+zQXhMFZQMiWWWsoBmengw0ijeRqe11dv:OVB6QMbBvpShBv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T182659C12F7D24876D05202388CBAA3366D397F641AA5CB47AFB0DE2D1E76A817C34357
sha3_384: 90007bc111294c31c9789ffb0ef4e89393506c0dc69d4b3897f2f76b8e2c7031943c2b0d75c7b117c7440e7a4970b042
ep_bytes: eb1066623a432b2b484f4f4b90e99c10
timestamp: 2009-02-15 11:19:27

Version Info:
CompanyName: Microsoft
FileDescription: Messenger
FileVersion: 1.0.0.0
InternalName: msn
LegalCopyright: Microsoft
LegalTrademarks: Microsoft
OriginalFilename: 
ProductName: Msn
ProductVersion: 1.0.0.0
Comments: 
Translation: 0x040c 0x04e4

Win32/Agent.NTI also known as:

ClamAV	Win.Malware.Zusy-9889629-0
Skyhigh	Artemis!Trojan
ESET-NOD32	a variant of Win32/Agent.NTI
APEX	Malicious
Cynet	Malicious (score: 100)
F-Secure	Trojan.TR/AD.Macoute.bcmgg
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/AD.Macoute.bcmgg
Kingsoft	malware.kb.a.742
Xcitium	TrojWare.Win32.Antavmu.~pnt@1su381
Microsoft	Trojan:Win32/Dynamer!rfn
McAfee	Artemis!179FFA5785EA
VBA32	suspected of Trojan.Downloader.gen
Rising	Trojan.Generic@AI.80 (RDML:2ciM37+q1bTcAMBhRJfzKw)

How to remove Win32/Agent.NTI?

Win32/Agent.NTI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X