Malware

How to remove “Win32/PSW.Agent.OIN”?

Malware Removal

The Win32/PSW.Agent.OIN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/PSW.Agent.OIN virus can do?

  • Possible date expiration check, exits too soon after checking local time
  • A process attempted to delay the analysis task.
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Steals private information from local Internet browsers

How to determine Win32/PSW.Agent.OIN?


File Info:

crc32: 2805991F
md5: e44ea354607fc33f9ad629e208375723
name: wyfdggm.exe
sha1: 105da91cfa1460c6b7646c1933597a7043b9af8b
sha256: 885d8a634aa285f0b049f943515cd5c0bfca342bd14b11b055f37f392ecc7acb
sha512: 1bf83723297ef0bfa02dc16708f1a2a77b0c5aa9595bbc3a23fcefd184a0528ab01c48a54d8a144793ebd84c2d54fbffadd243a34e1c6597651f2266fc9a2b0e
ssdeep: 24576:6WY5rankwN2aE6lydf8YWNXFDmvk81xjBP6lU0+73HuLMwiJTEYxZ4HeI4rXx:xfv3ydkYVc8rjZ78eTEYxZ4q
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

FileVersion: 1.0.0.1
ProductVersion: 1.0.0.1
Translation: 0x0804 0x04b0

Win32/PSW.Agent.OIN also known as:

BkavW32.AIDetectVM.malware
DrWebTrojan.PWS.Stealer.28259
MicroWorld-eScanTrojan.GenericKDZ.65578
ALYacTrojan.GenericKDZ.65578
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusPassword-Stealer ( 0055d9711 )
BitDefenderTrojan.GenericKDZ.65578
K7GWPassword-Stealer ( 0055d9711 )
CyrenW32/Trojan.SUSD-4591
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Trojan-gen
GDataTrojan.GenericKDZ.65578
KasperskyTrojan.Win32.Chapak.ekbi
AlibabaTrojanPSW:Win32/Chapak.2c667e90
ViRobotTrojan.Win32.Z.Agent.1726976.A
AegisLabTrojan.Win32.Generic.4!c
TencentMalware.Win32.Gencirc.10b91b6b
Ad-AwareTrojan.GenericKDZ.65578
SophosMal/Generic-S
F-SecureTrojan.TR/PSW.Agent.vxoai
ZillyaTrojan.Agent.Win32.1304567
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.AdwareKZip.th
EmsisoftTrojan.GenericKDZ.65578 (B)
IkarusTrojan-PSW.Agent
JiangminTrojan.Chapak.jdl
AviraTR/PSW.Agent.vxoai
Antiy-AVLTrojan[PSW]/Win32.Mimikatz
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D1002A
ZoneAlarmTrojan.Win32.Chapak.ekbi
MicrosoftTrojan:Win32/Occamy.C
McAfeeArtemis!E44EA354607F
MAXmalware (ai score=80)
VBA32Trojan.Beam
MalwarebytesSpyware.PasswordStealer
PandaTrj/GdSda.A
ESET-NOD32a variant of Win32/PSW.Agent.OIN
TrendMicro-HouseCallTROJ_GEN.R002H0CCK20
RisingDownloader.Agent!1.C137 (CLOUD)
YandexTrojan.PWS.Agent!HamjRg/AEEs
SentinelOneDFI – Suspicious PE
FortinetW32/Agent.OIN!tr
WebrootW32.Trojan.Gen
AVGWin32:Trojan-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_60% (W)
Qihoo-360Win32/Trojan.06f

How to remove Win32/PSW.Agent.OIN?

Win32/PSW.Agent.OIN removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment