Should I remove “Win64/TrojanDownloader.Agent.IY”?

The Win64/TrojanDownloader.Agent.IY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win64/TrojanDownloader.Agent.IY virus can do?

Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX

How to determine Win64/TrojanDownloader.Agent.IY?


File Info:
crc32: 9A4DD5FE
md5: 0a31ae5882697455a071f73191ed661c
name: 0A31AE5882697455A071F73191ED661C.mlw
sha1: 06c4e2c9a71dcada5dc6c090263df05bbdbd7e7e
sha256: fbeef8381db0c3c66d5646d8f2820ff08029f703d1891e490a102a3e8cdd1936
sha512: 18fcbf06a9c3158f2eb52df990e75ccdb6270663e37a02d712e76bbf04511f84b87589da9f58772efb1f2ddde64652655a3c3e520e84dcaede0d91f8d433e99e
ssdeep: 3072:0E5lmxpxrGySdgzfZYfuX9nW1amC6Yvbt7GPrLcj0qVqEiV8Io3rbq:0rxGySdMEuX9MamC6Yx7Esj7qJVS3rb
type: PE32+ executable (GUI) x86-64, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: CONHOST.EXE
FileVersion: 10.0.19041.546
CompanyName: Microsoft
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.19041.546
FileDescription: x63a7x5236x53f0x7a97x53e3x4e3bx8fdbx7a0b
OriginalFilename: CONHOST.EXE
Translation: 0x0409 0x04b0

Win64/TrojanDownloader.Agent.IY also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36454273
FireEye	Generic.mg.0a31ae5882697455
ALYac	Trojan.GenericKD.36454273
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.36454273
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.882697
Cyren	W64/Trojan.VFZZ-3272
Symantec	W97M.Downloader
Avast	Win64:Malware-gen
Kaspersky	Trojan.Win64.Miner.amld
Alibaba	TrojanDownloader:Win64/Miner.525b9e3a
Rising	Downloader.Agent!8.B23 (CLOUD)
Ad-Aware	Trojan.GenericKD.36454273
Sophos	Mal/Generic-S
Comodo	Malware@#cudm6rgue82k
F-Secure	Trojan.TR/Dldr.Agent.yvlbq
DrWeb	Trojan.BtcMine.3531
McAfee-GW-Edition	BehavesLike.Win64.Fake.cc
MaxSecure	Trojan.Malware.300983.susgen
Emsisoft	Trojan-Downloader.Agent (A)
Ikarus	Trojan-Downloader.Win64.Agent
Avira	TR/Dldr.Agent.yvlbq
MAX	malware (ai score=97)
Kingsoft	Win32.Troj.Win64.am.(kcloud)
Microsoft	Program:Win32/Ymacco.AAFB
Gridinsoft	Malware.Win64.Gen.oa
Arcabit	Trojan.Generic.D22C3F81
AhnLab-V3	Trojan/Win32.Miner.C4368625
ZoneAlarm	Trojan.Win64.Miner.amld
GData	Trojan.GenericKD.36454273
Cynet	Malicious (score: 100)
ESET-NOD32	Win64/TrojanDownloader.Agent.IY
McAfee	RDN/Generic Downloader.x
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
APEX	Malicious
Tencent	Win64.Trojan-downloader.Agent.Eyb
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_96%
Fortinet	PossibleThreat.MU
AVG	Win64:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win64/Heur.Generic.H8oAnVsA

How to remove Win64/TrojanDownloader.Agent.IY?

Win64/TrojanDownloader.Agent.IY removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X