Worm.Agent.666 removal tips

Malware Removal

The Worm.Agent.666 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm.Agent.666 virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (4 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

www.bing.com
ocsp.digicert.com
crl3.digicert.com

How to determine Worm.Agent.666?


File Info:

crc32: 6320A99F
md5: 53fa9d3957e36788cc0ed59e77b12c98
name: 53FA9D3957E36788CC0ED59E77B12C98.mlw
sha1: a9635eeb7616ab782ca6722b656e77f1a628f6f0
sha256: 8ded592bcff53711bfa34eda941020f6fb69556e5bb701ecd952a58d6e8ed587
sha512: 7b244fe5f51b054196c5e00fe64cf7ce5149c1075780b3c692bacfac54b85ef03bbda3f4f5b36ba9b6893ae8b328aba434ec46ec51ada2ebaefd3a883ccc04f1
ssdeep: 6144:Zjluegb0Io5R4nM/40yJN72P+fa59VE0llGbBoEIzZiwyHxk/VVBsB:ZEegbIqhLapE0y2Fcwkk/Vjg
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Worm.Agent.666 also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.70799
CAT-QuickHealWorm.Sfone.A3
McAfeeArtemis!53FA9D3957E3
MalwarebytesWorm.Agent.666
SangforMalware
K7AntiVirusTrojan ( 0051918e1 )
K7GWTrojan ( 0051918e1 )
Cybereasonmalicious.957e36
InvinceaML/PE-A + Troj/Agent-BFWE
BitDefenderThetaAI:Packer.1CAA96EC1E
CyrenW32/S-b6c35ecc!Eldorado
SymantecW32.SillyWNSE
APEXMalicious
ClamAVWin.Malware.D46e2dc-6911509-0
KasperskyHEUR:Worm.Win32.Generic
BitDefenderTrojan.GenericKDZ.70799
NANO-AntivirusTrojan.Win32.Wofith.hzygna
TencentMalware.Win32.Gencirc.10b07aee
Ad-AwareTrojan.GenericKDZ.70799
EmsisoftTrojan.GenericKDZ.70799 (B)
F-SecureTrojan.TR/Crypt.ULPM.Gen
BaiduWin32.Worm.Agent.fj
VIPREWorm.Win32.Agent.cp (v)
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
SophosTroj/Agent-BFWE
IkarusWorm.Win32.Agent
GDataWin32.Worm.Sfone.B
JiangminWorm.Agent.tt
AviraTR/Crypt.ULPM.Gen
MAXmalware (ai score=82)
Antiy-AVLGrayWare/Win32.Agent.CP
KingsoftWin32.Troj.Generic_a.a.(kcloud)
ArcabitTrojan.Generic.D1148F
ZoneAlarmHEUR:Worm.Win32.Generic
CynetMalicious (score: 100)
AhnLab-V3Worm/Win32.Agent.R234001
Acronissuspicious
VBA32Worm.Agent
ALYacTrojan.GenericKDZ.70799
TACHYONWorm/W32.FakePorn.Zen
CylanceUnsafe
ESET-NOD32Win32/Agent.CP
RisingWorm.Agent!1.CEBD (CLASSIC)
SentinelOneStatic AI – Malicious PE
FortinetW32/Agent.CP!worm
AVGFileRepMalware
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360HEUR/QVM18.1.595E.Malware.Gen

How to remove Worm.Agent.666?

Worm.Agent.666 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment