How to remove “Win32/Agent_AGen.NW”?

The Win32/Agent_AGen.NW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Agent_AGen.NW virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Nitol malware family
• Created a service that was not started
• Anomalous binary characteristics

How to determine Win32/Agent_AGen.NW?

File Info:
name: 185FB96AE20EEF35BE19.mlw
path: /opt/CAPEv2/storage/binaries/5c0873373e5a590ebda5960908debd3191266023085be73d1f4c785c63543567
crc32: D85FD511
md5: 185fb96ae20eef35be19aaacbb24b8ee
sha1: e8fdf8d2992541c19bbda372ae7ed3c48fc63a68
sha256: 5c0873373e5a590ebda5960908debd3191266023085be73d1f4c785c63543567
sha512: 311e0abd13240fa0318596312a9d452f14b95fbbd05c026d095d6ef45f48fa0ad3bce6e67598c792928329e69954488ba839c85dfdb445e3a3588cef5e6fa75d
ssdeep: 49152:ECP1x3JmDgKbboXXEdEiR38WT5P89dkPNaSrpL0IuVwUvOZYVgofF:Eax3Jms6oEd1R38M5P89dkPNaSrpmXvv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B2A58D213B90947FC1733631854AB3BBEAFDA9306E76024356901E3D3AB4593992C76F
sha3_384: d81c9e642e9b92d1d85603e0eec051eb449d283542c8d0d328880cf71d8c4b24c79594c3ebbff7fba1456ef52a892de3
ep_bytes: e82ea20000e989feffff8bff558bec53
timestamp: 2022-01-28 07:01:39

Version Info:
CompanyName: TODO: 
FileDescription: mfcProject
FileVersion: 1.0.0.1
InternalName: mfcProject.exe
LegalCopyright: TODO: (C) 。保留所有权利。
OriginalFilename: mfcProject.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0804 0x04b0

Win32/Agent_AGen.NW also known as:

How to remove Win32/Agent_AGen.NW?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.