Win32/TrojanDownloader.Agent.EXU removal instruction

Malware Removal

The Win32/TrojanDownloader.Agent.EXU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/TrojanDownloader.Agent.EXU virus can do?

  • Attempts to connect to a dead IP:Port (886 unique times)
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Attempts to stop active services
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Win32/TrojanDownloader.Agent.EXU?


File Info:

crc32: 582EBC6C
md5: 680d9c8bb70e38d3727753430c655699
name: down.txt
sha1: 5e72192360bbe436a3f4048717320409fb1a8009
sha256: ddfd1d60ffea333a1565b0707a7adca601dafdd7ec29c61d622732117416545f
sha512: 789e9b295d91229f376840296a3f4680894fd99db574a1d44a5758f0d67d2afd3080b6bff296471928caa815572abf8bf5b3c99fa10c844c897dea3c7782693b
ssdeep: 1536:jALz/A04ZIgZY/zY7lJXST6irxfA9t4lm42OSu4W4UvaEJZLyF:cLECLsxQrrSylT2OSfQvJG
type: MS-DOS executable, MZ for MS-DOS

Version Info:

0: [No Data]

Win32/TrojanDownloader.Agent.EXU also known as:

MicroWorld-eScanGen:Trojan.Downloader.fmqaa08eR0ii
CMCVirus.Win32.Sality!O
McAfeeRDN/Generic Downloader.x
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderGen:Trojan.Downloader.fmqaa08eR0ii
K7GWRiskware ( 0040eff71 )
K7AntiVirusRiskware ( 0040eff71 )
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/TrojanDownloader.Agent.EXU
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Downloader.Win32.Generic
AlibabaTrojanDownloader:Win32/Huskfim.100f2e6b
TencentWin32.Trojan-downloader.Generic.Wmsz
Ad-AwareGen:Trojan.Downloader.fmqaa08eR0ii
EmsisoftGen:Trojan.Downloader.fmqaa08eR0ii (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.DownLoader32.46970
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Sivis.mc
FortinetW32/Generic!tr.dldr
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.680d9c8bb70e38d3
SophosMal/Generic-S
IkarusTrojan.Dropper
CyrenW32/Downloader.IVWY-0564
JiangminTrojanSpy.Stealer.hn
WebrootW32.Trojan.Gen
AviraTR/Dropper.Gen
MAXmalware (ai score=82)
Endgamemalicious (high confidence)
ArcabitTrojan.Downloader.fmqaa08eR0ii
ZoneAlarmHEUR:Trojan-Downloader.Win32.Generic
MicrosoftTrojanDownloader:Win32/Huskfim.A
Acronissuspicious
VBA32suspected of Trojan.Downloader.gen.h
ALYacTrojan.Downloader.Agent
TrendMicro-HouseCallTROJ_GEN.R020H01AB20
RisingDropper.Generic!8.35E (CLOUD)
SentinelOneDFI – Malicious PE
GDataGen:Trojan.Downloader.fmqaa08eR0ii
BitDefenderThetaAI:Packer.C9BEE6111F
AVGWin32:Malware-gen
Cybereasonmalicious.bb70e3
AvastWin32:Malware-gen
Qihoo-360Generic/HEUR/QVM18.1.8053.Malware.Gen

How to remove Win32/TrojanDownloader.Agent.EXU?

Win32/TrojanDownloader.Agent.EXU removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment