Win32/Agent.SXW information

The Win32/Agent.SXW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent.SXW virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Anomalous binary characteristics

How to determine Win32/Agent.SXW?

File Info:
name: 0F8ABA11514310147070.mlw
path: /opt/CAPEv2/storage/binaries/4a5fd7357fbda191b67ade731b5c67a915cebbad623673b9eec18e0459ebc273
crc32: AE93C2C8
md5: 0f8aba11514310147070147e1e79c267
sha1: 0bd373e0a70d7f84ec48ae453516be82f9443646
sha256: 4a5fd7357fbda191b67ade731b5c67a915cebbad623673b9eec18e0459ebc273
sha512: 0a5a85455f865635ef23f7872df6813e2c8adeca5d10cc513ecc917dd846b122d78c9fb7dd0c80445011eeec45520595e46b0ce4ad5b5c860c4ffa32dcc523e6
ssdeep: 384:OI5kdpipuk2hsYHCUC1BCV/oasKPIMCwkoqjPqjPqjPqjPqjF:OeyEpuk2QUmAV/bsKQMgjSjSjSjSjF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T145B4D803B6C48996C2D71532109BF17AA7F1EC16CA367397768C5F6B2EF6321082D687
sha3_384: 261064052e6e7a584057373bf266c6724f66c0685732c7a1f5690f4571bfb4bc583da73bc8f930b16066add8173d6739
ep_bytes: b8608e40005064ff3500000000648925
timestamp: 2011-06-20 12:42:00

Version Info:
Comments: 
CompanyName: Shenzhen QVOD Technology Co.,Ltd
FileDescription: QvodInstall Module
FileVersion: 3, 0, 0, 0
InternalName: QvodInstall.exe
LegalCopyright: Copyright(C) 2006-2009 QVOD
LegalTrademarks: 
OriginalFilename: QvodInstall.exe
PrivateBuild: 
ProductName: QvodInstall Module
ProductVersion: 3, 0, 0, 0
SpecialBuild: 
Translation: 0x0804 0x04b0

Win32/Agent.SXW also known as:

How to remove Win32/Agent.SXW?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.