How to remove “Win32/Agent_AGen.CQD”?

The Win32/Agent_AGen.CQD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Agent_AGen.CQD virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Win32/Agent_AGen.CQD?


File Info:
name: 9F312DD3498A4F80FB6A.mlw
path: /opt/CAPEv2/storage/binaries/c861fa88dc95bf168f3c58d2a1c157ede0751f353089186f02f46b218faf857f
crc32: 5A901CE7
md5: 9f312dd3498a4f80fb6ae199c31d40cb
sha1: c352ca7160053dc52c66455f459c7a09237548c6
sha256: c861fa88dc95bf168f3c58d2a1c157ede0751f353089186f02f46b218faf857f
sha512: 768724f19bf4738c159e6354ef0caa545fffce8b892cdc7077997c65d5fc35c8b8cc8fa6949ebd8ef1c8986dd37ea0d944a4264739aaa995fba56eba69bc8475
ssdeep: 192:9oKabynuEGdSuD7p2q4XXXXXXXXXX/ZcZcZcZsPhRiQjvD/8blqDE045HQX///:9oKqynKp2qBKvDnDE045H
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FA032C23278DE478EF9EC3B36250D792A047F129EF694640492FE1F61E2812D6B60F17
sha3_384: 8f31b68ead7e0b5f19450491076c78f5a9eb4d6cb868daa3b309fdfb228945510683744986e7e5ae51260ca259feb356
ep_bytes: a700612ffc4fe9f7ebadd75acc0eb2a4
timestamp: 2007-07-24 01:52:49

Version Info:
0: [No Data]

Win32/Agent_AGen.CQD also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Cerbu.173465
Skyhigh	BehavesLike.Win32.Generic.pz
ALYac	Gen:Variant.Cerbu.173465
Malwarebytes	MachineLearning/Anomalous.100%
VIPRE	Gen:Variant.Cerbu.173465
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Cerbu.173465
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Cerbu.D2A599
BitDefenderTheta	Gen:NN.ZexaE.36792.cmY@aihbphl
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent_AGen.CQD
APEX	Malicious
Rising	Trojan.Generic@AI.100 (RDML:JE1JaZxGbF7MjCuEQ4C7DA)
Sophos	Generic ML PUA (PUA)
Google	Detected
F-Secure	Trojan.TR/Patched.Ren.Gen
Zillya	Trojan.AgentAGen.Win32.21838
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.9f312dd3498a4f80
Emsisoft	Gen:Variant.Cerbu.173465 (B)
SentinelOne	Static AI – Malicious PE
Varist	W32/S-9bdefeb6!Eldorado
Avira	TR/Patched.Ren.Gen
MAX	malware (ai score=87)
Kingsoft	malware.kb.a.998
Microsoft	Trojan:Script/Phonzy.B!ml
GData	Gen:Variant.Cerbu.173465
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!9F312DD3498A
DeepInstinct	MALICIOUS
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R03BH0CJU23
Tencent	Trojan.Win32.Patched.kd
Ikarus	Trojan.Patched
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Agent.C40A!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.160053
Avast	Win32:Evo-gen [Trj]

How to remove Win32/Agent_AGen.CQD?

Win32/Agent_AGen.CQD removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X