Win32/Agent.RUG removal

The Win32/Agent.RUG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Agent.RUG virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Agent.RUG?


File Info:
name: C74523FFE6375510FD34.mlw
path: /opt/CAPEv2/storage/binaries/fbdc5e43d4f3e9e59c2e85d51a91f7b7c4b7c6cf985933c485e92ec58398b079
crc32: 7886B3B0
md5: c74523ffe6375510fd3443a2b83152dd
sha1: 8d23892740aaff013b32449de4f7386bb36ec7d2
sha256: fbdc5e43d4f3e9e59c2e85d51a91f7b7c4b7c6cf985933c485e92ec58398b079
sha512: 6125b41b5ba009ce2312716f98483c6a3c046e1a21c189e91eed9bbcd6c0b15a58b7e01870b931273aa85d9ce5b55c0d9b011026e8ebdc1bc608e8de55fae66d
ssdeep: 6144:phGEp2t28PvUer8RqsXwYsZnc7CUqciEE935A3Q+sl8khM3kMQrgnik:3mE9JA1evbq0g+Hn0OD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11D742A54FB41FEF5E8498BBE10F2231952DEA680DB1CF6373810FE68045EB2856B3956
sha3_384: 6e771766128e64ec4e7e39a698047ac0bf940675dd6d492337fe5e7606e94139b3069af9cd6627841c2795bd6aefd4b0
ep_bytes: 83ec0cc7059853400001000000e85e0a
timestamp: 2018-07-25 02:14:01

Version Info:
0: [No Data]

Win32/Agent.RUG also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.mfqG
Elastic	malicious (high confidence)
FireEye	Generic.mg.c74523ffe6375510
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00506b7d1 )
Alibaba	Trojan:Win32/Leivion.bbc6fabc
K7GW	Trojan ( 00506b7d1 )
Cybereason	malicious.fe6375
BitDefenderTheta	AI:Packer.7F21E64A1E
Cyren	W32/Veilev.A!Eldorado
Symantec	Backdoor.Veilev!g1
ESET-NOD32	a variant of Win32/Agent.RUG
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Ursu.ffwjkf
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.ATRAPS.Yfow
Sophos	ATK/Veil-B
F-Secure	Trojan.TR/ATRAPS.Gen7
TrendMicro	TROJ_GEN.R002C0DGS23
McAfee-GW-Edition	BehavesLike.Win32.Generic.fm
Ikarus	Trojan.Win32.Veilev
GData	Win32.Trojan.Agent.B36RFT
Jiangmin	Trojan.Generic.cdpur
Avira	TR/ATRAPS.Gen7
Antiy-AVL	Trojan/Win32.Leivion
ViRobot	Trojan.Win.Z.Veilev.366704
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Leivion.L
Google	Detected
AhnLab-V3	Trojan/Win32.Agent.R346797
McAfee	GenericRXFR-FN!C74523FFE637
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DGS23
Rising	Trojan.Agent!8.B1E (TFE:5:37UQtYpsmfK)
Yandex	Trojan.GenAsa!zAOjTTTKRQE
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Veil.C!tr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32/Agent.RUG?

Win32/Agent.RUG removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X