Win32/Agent.ONS removal guide

The Win32/Agent.ONS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Agent.ONS virus can do?

Authenticode signature is invalid

How to determine Win32/Agent.ONS?


File Info:
name: F1AC55C0B119E9CB6F72.mlw
path: /opt/CAPEv2/storage/binaries/d9260b7ab7d59537d6d07bd48188d4a1e17e42422841bfd9697ed266ec04c08f
crc32: 52B12652
md5: f1ac55c0b119e9cb6f72049c2fe824bb
sha1: 9a869edf26bda6f10dae7744f0f7cc85c363e71b
sha256: d9260b7ab7d59537d6d07bd48188d4a1e17e42422841bfd9697ed266ec04c08f
sha512: 569abfa369fa5f52ac89add6f3fd8adae5c0dca9c73c15ccc243fb541239bb5fafd37a2463ee21edba438023716dc38fc372334fdebffce2e46bf6fe2411786c
ssdeep: 384:bkzfevUQBYvTtHJQYQBoUBUHfNxEhpm56OovKSbBqHFRaOhWbN3QW:bkyhYrtpQYQBfBU/epm5yzqXalN3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T196037DE392B815B7FFF2077C0E22CA0D4CF6B7556EAAE02971AC10190D7A4D24E11E1B
sha3_384: bae4fcd2d98edec5353e476b8d4a19a18c56792ae210b47a7d120c0b521ec6198e00ed4685f9e44de34bd7ecac4afdd5
ep_bytes: 558bec6aff68a071400068a03b400064
timestamp: 2011-07-17 16:29:28

Version Info:
Comments: 
CompanyName: Microsoft Corporation
FileDescription: RndSeed
FileVersion: 0, 27, 0, 83
InternalName: rndseed
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: 
OriginalFilename: RndSeed.exe
PrivateBuild: 
ProductName: Microsoft® Windows® Operating System
ProductVersion: 0, 27, 0, 83
SpecialBuild: 
Translation: 0x0409 0x04b0

Win32/Agent.ONS also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	BackDoor.Rndseed.5
MicroWorld-eScan	Trojan.Peed.Gen
FireEye	Generic.mg.f1ac55c0b119e9cb
ALYac	Trojan.Peed.Gen
Cylance	Unsafe
VIPRE	Trojan.Peed.Gen
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004ee7ba1 )
K7GW	Trojan ( 004ee7ba1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.34606.cq0@a4t1MLpi
VirIT	Trojan.Win32.Generic.BYAC
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.ONS
APEX	Malicious
ClamAV	Win.Trojan.Peed-1027
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Peed.Gen
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.Peed.Gen
Emsisoft	Trojan.Peed.Gen (B)
F-Secure	Heuristic.HEUR/AGEN.1230642
McAfee-GW-Edition	BehavesLike.Win32.BadFile.pt
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Generic.ogkf
Google	Detected
Avira	HEUR/AGEN.1230642
Antiy-AVL	Trojan/Generic.ASMalwS.2779
Microsoft	Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Peed.Gen
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.HDC.C110988
McAfee	Artemis!F1AC55C0B119
MAX	malware (ai score=89)
VBA32	Trojan.Rnds
Rising	Malware.Undefined!8.C (TFE:5:zcuf7Oi7y6H)
Yandex	Trojan.GenAsa!UlJarm79jbQ
TACHYON	Trojan/W32.Rnds.40960.B
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.ONS!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.0b119e
Panda	Generic Malware

How to remove Win32/Agent.ONS?

Win32/Agent.ONS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X